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FOREWORD 


This  is  the  third  of  three  reports  submitted  under  Contract  No.  DAAA09-81- 
C-3006  conducted  by  I IT  Research  Institute,  Chicago,  Illinois,  for  the  U.  S. 

Army  ARRCOM,  Rock  Island,  Illinois.  This  report  describes  the  results  of  a 
hazards  analysis  of  the  Decontamination  Building,  Large  Items  Flashing  Chamber, 
Driverless  Tractor  System,  Offloading  Dock  and  Magazines  (Priority  3)  at  the 
Western  Area  Demilitarization  Facility  (WADF)  at  Hawthorne,  Nevada.  A  hazards 
analysis  report  was  submitted  during  July  1982  for  Priority  1  (Steam  and 
Hydraulic  Systems)  and  a  hazards  analysis  was  submitted  during  November  1982 
for  the  Priority  2  systems  (Preparation  building.  Accumulator,  Mechanical 
Removal  Building  and  Large  Cells).  The  Priority  3  Report  is  submitted  in  two 
volumes,  Volume  2  containing  fault  tree  diagrams  for  the  systems  evaluated. 

The  primary  I IT  Research  Institute  project  team  consisted  of  Ronald  Pape, 

Edmund  Swider,  Kim  Mniszewski,  Charles  Heilker,  and  Dwayne  Eacret.  Mr.  Thomas 
Grady,  a  private  consultant  with  considerable  experience  in  explosive  and  pro¬ 
pellant  operations,  helped  scrutinize  the  results  of  the  analysis.  Mr.  Arne 
Wiederman  of  AT  Research  Associates*  Inc.  (a  consultant  to  IITRI  on  this  program) 
did  an  independent  evaluation  of  the  potential  hazard  to  personnel  in  corridors 
and  control  rooms  from  the  air  blast  produced  by  an  explosion  in  the  various 
cells.  This  analysis  is  presented  in  Appendix  B. 

Respectfully  submitted 
I IT  RESEARCH  INSTITUTE 

Ronald  Pape 
Senior  Engineer 


APPROVED  BY 


la  Napqpensky 
Manager 
Fire  and  Explosion  Research 
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1.  INTRODUCTION 


This  report  contains  the  results  of  a  hazards  analysis  of  the  Decontamination 
Building,  Large  Items  Flashing  Chamber,  Driverless  Tractor  System,  Offloading 
Dock  and  Magazines  at  the  Western  Area  Demilitarization  Facility  (WADF)  at 
Hawthorne,  Nevada.  The  methodology  used  was  a  combination  of  failure  modes 
and  effects  analysis  (FMEA)  and  fault  tree  analysis  (FTA) ,  with  quantification 
accomplished  through  the  use  of  a  fault  tree  computer  model.  These  techniques 
were  described  in  the  Priority  1  report  and  are  repeated  here  in  Appendix  A. 

The  hazards  analysis  that  was  conducted  produced  two  types  of  results. 

First,  the  scenarios  that  can  lead  to  a  hazardous  outcome  were  identified  by 
constructing  fault  tree  logic  diagrams  for  each  plant  section.  Such  scenarios  are 
chains  of  events  or  combinations  of  events  that  must  occur  together  or  in 
sequence  to  cause  the  outcome  of  concern.  For  example,  for  an  operator  to 
become  burned  by  touching  a  hot  surface,  several  things  must  happen: 

1.  the  surface  must  be  sufficiently  hot  to  burn  someone,  and 

2.  an  operator  must  touch  the  hot  surface 

Both  of  these  events  are  necessary  in  order  for  the  operator  to  become  burned. 

The  combination  of  events  is  a  scenario.  To  evaluate  whether  such  a  scenario 
is  significant,  "probability  of  occurrence"  values  are  derived  for  each  event 
in  the  scenario,  thereby  making  it  possible  to  compute  the  overall  scenario 
probability  per  year,  or  expected  frequency  of  occurrence  averaged  over  an 
extremely  long  time  frame. 

All  the  scenarios  for  the  specific  plant  section  are  then  compared  based 
on  their  derived  probabilities  per  year.  Naturally,  those  scenarios  with  the 
highest  probability  values  are  most  critical  and  must  be  addressed  first. 

Section  2  of  this  report  summarizes  the  systems  at  the  Western  Area  Demili¬ 
tarization  Facility  that  have  been  evaluated  under  Priority  3.  Section  3  pre¬ 
sents  the  hazards  analysis  results  for  each  plant  area.  Section  4  provides 
recommendations  and  conclusions  based  on  the  results  of  this  analysis.  In 
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addition  to  a  discussion  of  the  hazards  analysis  methodology  in  Appendix  A, 
the  Appendix  B  provides  an  independent  evaluation  of  potential  hazards  to 
personnel  in  corridors  or  control  rooms  of  the  various  buildings  at  WADF, 
particularly  concerning  the  protection  provided  by  the  blast  doors  or  cells. 
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2.  PRIORITY  3  SYSTEMS 


The  systems  at  WADF  evaluated  for  potential  hazards  under  Priority  3  in¬ 
clude  the  Decontamination  Building  the  Large  Items  Flashing  Chamber,  the 
Driverless  Tractor  System,  the  Offloading  Dock  and  the  Storage  Magazines. 

These  systems  are  described  briefly  in  this  Section. 

2.1  DECONTAMINATION  BUILDING 

This  building  contains  three  furnaces  to  decontaminate  various  items. 
First,  a  rotary  type  furnace  is  used  for  small  arms  ammunition  containing  lead. 
The  items  are  placed  into  a  rotating  dumper  and  transferred  into  a  conveyor 
which  carries  them  to  the  furnace  feeder.  The  lead  items  furnace  is  a  rotary 
type  oil  burner  furnace.  At  the  burner  end,  a  narrow  opening  is  left  between 
the  furnace  and  burner  flanges  for  liquid  lead  (1)  to  drip  into  a  trough, 

(2)  be  carried  to  a  water  bath  for  cooling  and  (3)  then  be  carried  by  conveyor 
to  a  hopper  for  subsequent  removal  by  truck.  The  remaining  refuse  from  the 
furnace  is  deposited  onto  a  second  conveyor  and  carried  to  a  magnetic  (ferrous/ 
nonferrous)  separator  where  it  is  directed  into  a  "ferrous  or  nonferrous" 
semi -trailer  positioned  under  the  separator  chute. 

A  second  rotary  furnace,  the  detonating  items  furnace,  is  quite  similar 
to  the  lead  items  furnace.  This  incinerator  does  not  have  the  spacing  between 
flanges  at  the  burner  end  since  liquid  lead  is  not  to  be  removed.  A  separate 
conveyor  is  used  to  recycle  some  of  the  refuse  to  maintain  the  proper  depth  of 
material  in  the  furnace  body.  Since  this  furnace  must  withstand  items  detonat¬ 
ing  within,  the  walls  are  stronger  than  the  lead  items  furnace,  and  the  center 
section  is  recessed  to  increase  the  residence  time  of  the  items  near  the 
center  of  the  cylinder. 

The  fifth  and  sixth  cells  in  the  decontamination  building  house  the  tray 
type  flashing  furnace.  Here,  moderate  sized  processed  items  (cleaned  out), 
which  can  be  inspected  to  preclude  presence  of  a  significant  amount  of  ener¬ 
getic  material,  will  be  decontaminated.  Items  will  be  processed  through 
a  conventional  heat-treating  type  furnace  (fire  brick  walled)  where  they  will 
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be  heated  to  a  temperature  at  which  any  residual  energetic  material  decomposes 
or  burns.  Typical  items  to  be  processed  include  rocket  warheads  (e.g.  2.75  in., 
5.0  in.),  depth  charge  warheads  (e.g.  MK4,  MK5) ,  and  gun  ammunition  projectiles 
(e.g.  40mm  through  5"/54).  Items  are  loaded  into  trays  in  the  loading  area, 
either  manually  or  with  the  help  of  a  mechanical  assist.  The  trays  are  then 
loaded  through  a  blast  lock  into  the  furnace.  Four  trays  are  continally 
present  in  the  furnace.  At  intervals  of  approximately  7  1/2  minutes,  a  new 
tray  enters  and  a  processed  tray  leaves  the  furnace  where  it  is  checked  for 
proper  final  temperature  conditions.  Then  it  is  raised  on  a  skip  loader  where 
the  items  are  dumped  into  a  dumpster.  Trays  are  returned  by  first  being 
cooled  in  a  water  spray  chamber  and  then  sent  into  the  tray  loading  area  for 
recycling,  by  means  of  conveyor  equipment. 

2.2  LARGE  ITEMS  FLASHING  CHAMBER 

In  the  flashing  chamber,  smokeless  powder  is  used  to  burn  off  residual 
explosive  left  in  larger  items  from  which  the  bulk  of  the  explosive  already 
has  been  removed.  Decontamination  of  these  items  is  required  before  the  metal 
components  can  be  sold  as  scrap.  Deactivation  and/or  decontamination  of  con¬ 
taminated  items  has  been  accomplished  in  the  past  primarily  by  exposing  the 
material  to  a  high  temperature  for  a  prolonged  time  such  that  the  energetic 
material  decomposes,  burns  or  detonates.  This  is  accomplished  by  placing 
the  items  in  a  bonfire  in  a  field  burn.  Short  duration  high  temperature  ex¬ 
posures  have  also  been  used  in  the  past  by  placing  smokeless  powder  in  the 
internal  cavities  of  the  item  and  igniting  the  powder.  According  to  the 
Batelle  report  (reference  1),  such  "flashing  has  been  found  to  be  effective 
in  completely  destroying  residues  of  explosive  on  or  in  the  anmmition 
items".  As  discussed  in  the  results  section,  there  is  some  question  as  to 
whether  flashing  really  will  be  effective  in  all  cases  due  to  the  shortness  of 
the  high  temperature  pulse. 

At  WADF  flashing  is  to  be  accomplished  inside  a  containment  chamber 
designed  to  prevent  products  of  combustion  from  escaping  to  the  atmosphere. 

It  is  designed  to  maintain  structural  integrity  in  the  event  of  the  detonation 
of  a  120  lb  (TNT  equivalent)  line  charge  along  the  chamber's  axis.  During 
a  burn,  the  combustion  products  are  ducted  underground  to  a  regenerative 

heat  exchanger  (a  mass  of  steel  tubes)  and  to  a  bag  house  for  pollution  control. 
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Pneumatically  driven  mine  cars  are  to  be  used  to  carry  the  contaminated 
items  from  the  driverless  tractor  (item  receiving  area)  into  the  car  preaparation 
enclosure,  where  the  smokeless  powder  is  layed,  and  then  into  the  flashing 
furnace.  A  narrow  gage  track  loop  routes  the  mine  cars  into  the  chamber  and 
then  back  out  to  a  cool  off  area.  A  massive  door  covers  the  chamber's  entrance 
during  a  burn,  and  all  personnel  are  to  return  to  the  Decontamination  Building 
at  that  time. 

2.3  DRIVERLESS  TRACTOR  SYSTEM 

A  driverless  tractor  (DLT)  and  ammunition  cart  system  utilizing  Prontow 
601  vehicles  has  been  installed  at  WADF.  Two  independent  DLT  control  systems 
are  present.  One  network  (region  1)  moves  tractors  between  the  Off  Loading 
Dock  and  the  Preparation  Building.  The  second  network  (region  2)  moves 
tractors  between  the  Preparation  Building  and  the  various  process  buildings 
at  the  site.  The  battery  powered  tractors  are  guided  by  a  low  frequency 
signal  transmitted  from  wires  layed  in  slots  cut  in  the  concrete  guide  paths. 

An  amber  strobe  light  indicates  when  a  vehicle  is  operating  automatically.  A 
horn  sounds  on  all  automatic  starts  and  stops.  Dynamic  braking  of  the  vehicle 
is  accomplished  by  means  of  the  traction  motor.  A  safety  bumper  is  attached 
to  the  front  of  the  tractor  which  actuates  an  emergency  stop  if  it  strikes  a  person 
or  other  object.  High  pressure  nitrogen  or  air  supplies  power  for  quick  braking 
of  the  train.  A  DLT  train  consists  of  a  tractor  and  one  to  four  carts,  the 
total  live  load  being  up  to  22,500  pounds.  The  minimum  train  speed  is  2.5  mph 
and  the  maximum  is  3.5  mph.  The  tractors  can  be  operated  in  either  the  auto¬ 
matic  mode  while  on  the  guide  paths  or  in  the  manual  mode  of  operation.  In  .the 
manual  mode  the  operator  stands  on  the  cart.  A  deadman  switch  must  be  depressed 
as  the  vehicle  moves  in  this  mode.  The  vehicle  is  accelerated  using  a  foot 
pedal  with  several  discrete  speed  positions. 
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2.4  ‘OFF  LOADING  DOCK 

Munitions  items  to  be  demilitarized  enter  the  facility  at  the  off  loading 
dock.  The  off  loading  dock  is  a  conventional  earth  covered  unloading  structure 
designed  to  handle  delivery  of  energetic  materials  by  train  or  truck.  It 
consists  primarily  of  two  adjacent  earth  covered  tubes  for  unloading  trains, 
but  also  has  unprotected  docks  next  to  the  igloo  type  structure.  Items  are 
to  be  taken  from  the  unloading  dock  to  the  preparation  building  via  the  driver¬ 
less  tractor  system. 
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3.  SUMMARY  OF  HAZARDS  ANALYSIS  RESULTS 


In  this  section,  the  dominant  hazard  scenarios  are  discussed  for  each  of 
the  Priority  3  systems.  The  estimated  probabilities  per  year  and  typical  or 
"worst  case"  scenarios  are  presented  for  each  of  these  potential  problem 
areas. 

3.1  DECONTAMINATION  BUILDING  -  DETONATING  ITEMS  ROTARY  FURNACE 

Results  of  the  fault  tree  analysis  of  the  detonating  items  rotary 
furnace  yield  an  overall  major  system  Category  I  or  II  incident  frequency  of 
8.07  x  10~4  per  year.  The  analysis  showed  that  the  three  most  probable  scenarios 
caused  loss  of  production  due  to  repair  time  greater  than  3  days.  These  were 
caused  by  premature  erosion  of  the  furnace  retort  necessitating  replacement 
and  system  damage  from  detonation  of  items  outside  of  the  furnace.  These 
scenarios  are  discussed  below. 

PREMATURE  WEAR  OF  FURNACE  RETORT 

Two  scenarios  described  premature  erosion  of  the  furnace  retort  resulting 
from  human  error  during  furnace  operation. 

The  first  scenario  has  an  estimated  frequency  of  1 .45  x  10~4  per  year. 

It  is  described  in  the  summary  table  below: 

Fault  Tree  Probability/ 

Component  No.  Description  Frequency  Used 


C93 

Detonable  items  are  fed  into  rotary 
furnace 

1. 

C94 

Operator  incorrectly  permits  excessive 
amount  of  items  to  be  fed  into  furnace 

.07/hr 

C95 

Control  room  operator  does  not  catch 
the  error  via  CCTV 

.001 

C96 

Excessive  amounts  of  explosive  are 
detonated  in  furnace 

1.0 

C97 

Control  room  operator  does  not  pick  up  cues 
to  reason  that  excessive  amounts  of 

explosive  are  detonated. 
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Fault  Tree 

Probability/ 

Component  No. 

Description 

Frequency  Used 

C98 

Premature  erosion  of  furnace  retorts 
over  an  extended  time  cause  need  for 
repair 

1. 

C276 

Time  to  repair  furnace  retort  >_  3  days 

.05 

The  second  production  loss  scenario  has  an  estimated  frequency  of  1.17  x  10~4 
per  year.  It  is  described  below: 

Fault  Tree 

Component  No.  Description 

C55  Detonable  items  are  fed  into  rotary 

furnace 

E33  Operator  incorrectly  adjusts  controls 

C56  Items  detonate  in  unstrengthened  furnace 

retort 

C63  Operator  does  not  detect  improper  ex¬ 

plosion  location  from  acoustical  detector 

C57  Premature  erosion  of  unstrengthened  furnace  1. 

retort  over  an  extended  time  causes  repair 

C58  Time  to  repair  unstrengthened  furnace  .05 

retort  >  3  days 


Probability/ 
Frequency  Used 

1. 

3.75  x  10“Vhr 
.5 

.003 


SYSTEM  DAMAGE  FROM  DETONATION  OF  ITEMS  OUTSIDE  OF  THE  FURNACE 


The  third  scenario  described  furnace  system  damage  caused  by  items  which 
have  passed  through  the  furnace  and  detonate  outside  of  it.  This  scenario  has 
an  estimated  frequency  of  7.80  x  10~5  per  year.  It  is  detailed  in  the  summary 
table  below: 


Fault  Tree 
Component  No. 

Cl  47 

Cl  54 


Probability/ 

Description  Frequency  Used 

Detonable  items  are  fed  into  rotary  1. 

furnace 

Latent  heating  of  items  occur  due  to  3.75  x  10  4/hr 

operator  incorrectly  adjusting  furnace 

controls 
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Fault  Tree 

Probability/ 

Component  No. 

Description 

Frequency  Used 

Cl  48 

Operator  is  unaware  of  latent  heating 
condition  -  does  not  check  acoustical 

.01 

detector 

Cl  49 

Items  detonate  on  scrap  recycle  conveyor 

.1 

Cl  50 

Major  system  damage  occurs  i.e.  scrap 
conveyor,  fuel  oil  pump  etc.  Repair 
time  is  greater  than  3  days 

.05 

OTHER  POTENTIAL  HAZARDS 


The  scenarios  described  above  were  categorized  as  a  level  I  or  II  incident 
because  of  the  lengthy  repair  time  but  were  of  little  other  consequence.  A 
potential  hazard  with  far  greater  consequences  is  that  of  a  truck  driver 
hitting  the  nearby  unprotected  propane  tank  while  transporting  the  scrap  metal 
recovery  trailer.  This  scenario  has  an  estimated  frequency  of  3.25  x  10~6  per 
year  and  is  detailed  below. 


Fault  Tree  Probability/ 

Component  No.  Description  Frequency  Used 


Cl 64  Empty  semi-truck  &  trailer  arrives  6.25  x  10-3 

to  transport  full  trailer  of  scrap 
metal 


Cl  65  Semi -truck  parks  and  unhooks  empty  .05 

trailer  near  propane  tank 

C166  Semi-truck  attaches  to  full  trailer  .05 

and  also  parks  it  near  propane  tank 

Cl 67  Semi-truck  attaches  to  empty  trailer  to  1. 

manuever  under  recovery  chute 

Cl 68  Truck  driver  maneuvers  truck  and  trailer  1.  x  10“3 

but  does  not  see  propane  tank 

Cl 69  Truck  driver  hits  propane  tank  and  ruptures  .1 

it  or  damages  valve  causing  leak 

Cl 71  Ignition  source  present  .5 

Cl 72  Explosion  occurs  causing  damage/severe  1. 

injury 
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'While  the  probability  of  such  an  incident  happening  is  low  at  a  frequency 
of  3.2  x  10~e  per  .year,  the  consequences  dictate  protection  of  the  propane  tank. 
This  protection  could  be  provided  at  low  cost  by  strategically  located  posts 
similar  to  those  positioned  around  the  lightning  poles.  Proper  placement 
would  still  allow  easy  access  for  filling  the  tank. 

3.2  DECONTAMINATION  BUILDING  -  LEAD  ITEMS  ROTARY  FURNACE 

The  fault  tree  analysis  for  the  lead  items  rotary  furnace  gave  an  overall 
major  system  category  I  or  II  incident  frequency  of  1 .68  x  10~4  per  year.  The 
main  scenarios  were  those  of  production  loss  due  to  repair  time  greater  than 
3  days.  In  many  respects  the  lead  items  rotary  furnace  is  similar  to  the 
detonable  items  rotary  furnace  described  in  section  3.1.  The  starred  scenarios 
identified  below  are  so  similar  to  the  detonable  items  rotary  furnace  that  their 
discussion  is  not  repeated  here. 

•  Excess  explosive  detonated  in  furnace  due  to  incorrect  feed  rate 
involving  human  error.  Premature  erosion  of  furnace  retort 
necessitates  early  repair/replacement  of  retort.  (1.45  x  ID-4  per  year)* 

•  Human  error  results  in  incorrect  large  caliber  (20  mm  etc.)  deton¬ 
able  items  fed  into  lead  items  furnace.  Premature  erosion  of  furnace 
retort  necessitates  early  repair/replacement  of  retort.  (1.28  x  10“5 
per  year). 

t  Propane  tank  explosion  due  to  semi -truck  driver  hitting  nearby  un¬ 
protected  tank  (3.25  x  10-6  per  year)* 

INCORRECT  LARGE  CALIBER  DETONABLE  ITEM  FED  INTO  LEAD  ITEMS  FURNACE 

Due  to  the  proximity  and  similarity  between  the  two  rotary  furnaces  in  the 
Decontamination  Building,  it  is  possible  that  items  meant  for  the  detonating 
items  furnace  could  be  fed  into  the  lead  items  furnace  by  mistake.  If  this 
occurs,  the  retort  on  the  lead  items  furnace  could  be  damaged  or  at  a  minimum 
experience  premature  excessive  wear. 
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Fault  tree 
Component  No. 

Probability/ 

Description  Frequency  Used 

C21 

Operator  does  not  inspect  items  and 
loads  20mm  or  other  large  caliber 
detonable  items  into  dumper 

6  x  10-3/hr 

C22 

Control  room  operator  dumps  items 

and  does  not  see  that  20mm  items  are  fed 

into  furnace 

.01 

C23 

Excessive  amounts  of  explosive  are  detonated 
in  furnace 

.1 

C24 

Control  room  operator  does  not  pick  up  cues 
to  reason  that  excessive  amounts  are  detonated 

.01 

C25 

Premature  erosion  of  retorts  over  an  extend¬ 
ed  time  cause  repair 

1. 

C26 

Time  to  repair  retort  >_  3  days 

.05 

3.3  TRAY  TYPE 

FLASHING  FURNACE 

Results  of  the  fault  tree  analysis  of  the  tray  type  flashing  furnace  opera¬ 
tion  indicate  a  category  I  or  II  accident  frequency  of  8.93  x  10  per  year, 
excluding  injuries  and  illnesses  of  various  causes.  Of  these  8.93  x  10 
incidents  per  year,  8.28  x  10"3  are  mainly  due  to  in-furnace  detonations  and 
baghouse  fires.  Various  equipment  damage  scenarios  and  less  probable  explosion 
scenarios  constitute  the  remaining  6.48  x  10  ^  incidents  per  year. 

In  order  to  quantify  the  fault  tree  analysis,  scheduling  data  was 
required.  Since  long  term  production  rates  for  this  area  and  the  types  and 
quantities  of  items  to  be  processed  are  not  firmly  established  at  this  time, 
estimates  based  on  a  Batelle  report  were  used.  The  values  used  are  summarized 
below: 

•  The  nominal  production  rate  is  73  items/hour,  based  on  a  projected 
average  of  processing  rates  for  rocket  warheads,  depth  charge 
warheads,  and  gun  ammuniiton  projectiles  (assuming  there  are  equal 
quantities  of  each  item  type  available) 

t  The  nominal  skid  processing  rate  is  5.17  skids/hour,  based  on 
furnace  capacity  requirements,  an  estimated  operating  time  of  310 
minutes  per  shift,  an  estimated  furnace  processing  time  of  30 
minutes/skid,  and  the  abovementioned  nominal  production  rate. 
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•  "operations  will  take  place  during  two  shifts  per  day  (16  hours) 

The  most  serious  incidents  considered  are  those  involving  explosion  and  fire 
because  of  the  high  potential  human  and  property  losses.  The  most  significant 
of  these  are  described  below. 


FULL  ITEM  DETONATION  IN  FURNACE  (8.2  x  10~3/,year) 

The  scenario  dominating  the  fault  tree  results  here  is  that  of  a  full  item 
accidently  being  processed  through  the  furnace,  as  a  result  of  several  human 
errors  in  succession.  This  particular  scenario  has  an  estimated  frequency  of 
8.2  x  10”3  per  year.  It  is  described  in  the  summary  table  below. 


Fault  Tree 
Component  No. 

Description 

Probability/ 
Frequency  Used 

103 

Items  processed  through  furnace 

73/hour 

156 

Full  items  brought  from  preparation 
building  by  mistake  and  processed* 

2.7  x  10-8 

105 

Item  detonates  in  furnace** 

1.0 

106 

Major  damage  to  furnace  results** 

1.0 

*  based  on  3  human  errors  of  commission,  in  sending  the  driverless  tractor  to 
the  wrong  destination,  and  2  additional  inspection  errors,  several  of  these 
errors  being  of  common  cause. 

**conservative  engineering  estimates 


PARTIALLY  LOADED  ITEM  DETONATES  IN  FURNACE  (8.2  x  10"5/.year) 


Another  somewhat  similar  scenario  is  that  of  an  item  not  fully  cleaned  out 

beinq  entered  into  the  furnace,  aqain  ~.s  a  result  of  several  human  errors  in 

'  -5 

succession.  This  particular  scenario  has  an  estimated  frequency  of  8.2  x  10 

per  year.  It  is  described  in  the  summary  table  below. 


Fault  Tree 

Component  No.  Description 


Probability/ 
Frequency  Used 


103  Items  processed  through  furnace  73/hour 

157  Items  not  fully  cleaned  out,  with  si g-  2.7  x  10 

nificant  amount  of  explosive  remaining 
are  processed* 
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Fault  *Tree 

‘ 

Probability/ 

Component  No. 

Description 

Frequency  Used 

105 

Item  detonates  in  furnace** 

1.0 

106 

Major  damage  to  furnace  results** 

1.0 

*based  on  an  estimated  one  out  of  every  hundred  items  has  significant  explosive 
remaining,  together  with  3  human  errors  of  commission,  which  can  be  inspection 
errors  or  misorientation  types  (e.g.  placing  item  in  tray  upside  down  so  that 
explosive  cannot  drain  out) 

BAG  HOUSE  FIRES  (6  x  10'4/year) 

A  couple  of  scenarios  result  in  hot  exhaust  gas  temperatures  entering  the 

baghouse  above  the  ianition  or  damage  point  of  the  baghouse  materials.  The 

-4 

estimated  frequency  of  these  events  is  6.0  x  10  per  year.  An  example  of 
these  scenarios  is  given  in  the  table  below. 


Fault  Tree 
Component  No. 

Description 

Probability/ 
Frequency  Used 

117 

Items  are  being  processed  (furnace 
in  operation) 

1.0 

123 

Severe  corrosion  occurs  in  recuperators, 
reducing  heat  transfer* 

2.4  x  10 

118 

Exhaust  of  recuperator  rises  above  pre¬ 
scribed  level** 

1.0 

119 

Operator  doesn't  notice  indicator  display¬ 
ing  excessive  temperature  in  baghouse 
(human  error) 

0.003 

120 

Baghouse  materials  at  or  above  ignition 
temperature** 

1.0 

121 

Baghouse  fire  ensues** 

1.0 

*  estimated  once  in  ten  years 
**conservative  engineering  estimates 


EQUIPMENT  DAMAGE  DUE  TO  BUILDING  CRANE  PROBLEM  (3.49  x  10'5/year) 

In  this  scenario,  the  handling  of  heavy  equipment  with  the  building  crane 
results  in  sufficient  equipment  damage  to  suspend  furnace  operations  for  a 
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_5 

prolonged  time.  The 'estimated  frequency  of  this  event  is  3.49  x  10  incidents/ 
year.  An  example  of  this  scenario  is  given  below. 


Fault  Tree 
Component  No. 

Description 

Probability 
Frequency  Used 

138 

Building  crane  and  during  maintenance 
(assume  once  per  month) 

2.8  x  10'3/hour 

139 

Heavy  item  lifted 

1.0 

144 

Operator  makes  crane  control  errors 
causing  item  to  drop  (human  error) 

0.003 

140 

Drop  is  sufficient  for  equipment 
damage* 

1.0 

♦conservative  engineering  estimate 


OTHER  POTENTIAL  HAZARDS  IN  TRAY  TYPE  FLASHING  FURNACE  AREA 


Other  hazards  of  concern  here  include  the  following: 

•  There  may  be  an  operator  exposure  problem  from  Yellow  D  particles 
remaining  in  some  items 

•  Since  some  of  the  items  to  be  processed  as  well  as  the  trays/skids 
weigh  over  40  pounds,  there  is  concern  for  operator  safety  in 
transfer  operations. 

•  There  is  concern  for  the  safety  of  operators  handling  potentially 
hot  trays/skids  in  the  event  of  spray  cooling  chamber  malfunction. 
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3,4  -LARGE  ITEMS  FLASHING  CHAMBER 

The  hazards  analysis  of  the  large  item  flashing  furnace  yielded  an 
extremely  high  expected  frequency  of  occurrence  of  266/year.  This  was  due 
primarily  to  "items  not  decontaminated"  (237/year)  and  "operators  cut  on  items" 
(28/year).  Items  not  being  fully  decontaminated  is  considered  to  be  a  major 
hazard,  not  to  plant  personnel,  but  to  the  purchaser  of  the  scrap  metal. 

The  dominant  hazards  for  the  Large  Items  Flashing  Chamber  were  found  to 


incl  ude 

the  following: 

1. 

Items  not  Decontaminated 

237/year 

2. 

Operator  Cut  on  Items 

27.7/year 

3. 

Initiations  due  to  Electrostatic  Discharge 

1 .17/year 

4. 

Camera  in  Chamber  Ruined  due  to  No  Cooling 

0.469/year 

r\ 

5. 

Initiations  due  to  Local  Impacts 

7.9  X  10‘Vyear 

A 

6. 

Item  Impact  Scenarios 

5.39  X  10‘Vyear 

7. 

Operator  Injured  due  to  Use  of  Nonelectric 
Ignition  of  Powder  Train 

4.68  X  10"2/year 

8. 

Significant  Chamber  Damage  due  to  Explosion 
in  Chamber 

1.78  X  10-2/year 

9. 

Operator  Burned  on  Hot  Item 

1.56  X  lOvyear 

10. 

Gondola  Incidents  (i.e.  Derailments  or 

Collisions) 

1.067  X  10“3/year 

11. 

Initiation  due  to  Tightening  or  Loosening  a 
Contaminated  Bolt  While  Changing  Fixture  for 

Type  III  or  MK7  Container 

1.12  X  10“4/year 

r 

12. 

Initiation  due  to  Smoking  in  Area 

7.8  X  10”°/year 

r 

13. 

Operator  Locked  in  Chamber  During  Flashing 

4.62  X  10”D/year 

14. 

Baghouse  Damaged  due  to  Explosion  in  Flashing 
Chamber 

4.47  X  10"5/year 

This  analysis  is  based  on  a  single  shift  operation  since  there  are  only 
six  sets  of  mine  cars  currently  available  (only  enough  for  a  single  shift  due 
to  cool  down).  Six  flashing  operations  are  to  take  place  per  shift  (0.75 
flashing  operations/hour).  It  is  estimated  that  about  one  driverless  tractor 
carrying  items  will  arrive  per  hour  on  the  average,  and  one  driverless  tractor 
load  per  hour  will  arrive  carrying  smokeless  powder. 

The  dominant  hazard  scenarios  are  discussed  in  the  paragraphs  that 
follow. 
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ITEMS  NOT  DECONTAMINATED  (237/year) 

-T-he  estimated  rate  of  237  incidents  per  year  of  ineffective  flashing 


operati ons  corresponds  to  about  15  per  cent  of  the  items  processed  being  sold 
as  scrap  with  energetic  material  still  on  bolt  threads  or  other  hidden/pro¬ 
tected  areas.  Although  "flashing  has  been  found  to  be  effective"  according 
to  Reference  1,  IITRI  personnel  are  not  confident  that  all  the  contamination 
will  be  deactivated.  The  basic  concept  of  decontamination  by  means  of  emersing 
the  item  in  a  fire  is  to  heat  all  of  the  contaminant  above  the  temperature  at 
which  the  contaminant  will  decompose,  burn  or  detonate.  In  a  long  duration 
exposure,  a  reasonable  assurance  can  be  attained  that  the  metal  parts  (and  con¬ 
taminant)  are  all  heated  in  depth.  In  a  short  duration  (flash)  fire,  there 
may  not  be  adequate  time  for  the  high  temperature  to  penetrate  to  all  the 
areas  where  a  contaminant  may  be  present,  e.g.,  on  bolt  threads.  Therefore, 
a  serious  question  exists  as  to  whether  decontamination  will  occur  consis¬ 
tently  using  this  process;  and  it  is  recommended  that  frequent  detailed  in¬ 
spections  of  the  items  (bolt  threads,  etc.)  be  accomplished  at  WADF  until  a 
sound  data  base  is  developed  to  assure  that  contaminated  scrap  is  not  being 
sold  to  an  unknowing  user.  Visual  Inspection  of  the  exposed  surfaces  will  not 
necessarily  assure  adequacy  of  decontamination.  Cracks,  threaded  areas,  and 
subsurface  cavities  or  flaws  can  still  house  hidden  and  undetectable  explosive 
material . 


This  category  of  hazards  was  projected  to  come  about  by  several  possible 
means.  The  most  dominant  cause  was  merely  that  the  normal  flashing  procedure 
is  ineffective  and  the  remaining  contamination  is  not  uncovered  during  final 
inspection  of  the  items  (234/year).  In  addition,  the  powder  being  layed 
wrong  was  estimated  to  cause  2.34  incidents/year;  wrong  orientation  of  the 
item  or  the  mine  car  was  estimated  to  cause  0.234/year;  and,  a  wrong  ignition 
sequence  was  estimated  to  cause  0.234/year. 


A  typical  scenario  of  this  type  is  outlined  below: 

Fault  Tree 

Component  No.  Description 

2  Flashing  Operation  Frequency 

18  Normal  Flashing  Procedure  does 

not  decontaminate  items  on  cart 

27  Operator  does  not  Observe  Contamination 

(in  bolts  etc). 

*Based  on  technical  judgement 
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Probability/ 
Frequency  Used 

0.75/hour 

0.1* 

0.99 
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'OPERATOR  CUT  ON  ITEMS  (2.77/year) 

It  was  estimated  that  operators  would  be  cut  on  the  burrs  left  in  the 
holes  cut  in  items  or  at  saw  cuts  about  28  times  per  year.  A  typical  scenario 
of  this  type  is  as  follows: 


Fault  Tree 

Probability/ 

Component  No. 

Description 

Frequency  Used 

386 

Operator  must  work  on  item  with  saw 
cuts  present  (5  handlings/flashing  X 

3.75/hour 

.75  flashings/hour) 

389 

Operator  does  not  wear  gloves 

0.1 

391 

Exposed  skin  is  seriously  cut  on  saw 
cut  burr 

.05 

The  values  used  here  probably  correspond  more  to  an  operator  getting  cut 
on  the  burr  than  seriously  cut  --i.ee,  the  values  may  be  somewhat  conservative. 
However,  some  serious  cuts  during  handling  of  the  items  should  be  expected. 
These  will  occur  when  protective  clothing  including  leather  gloves  are  not 
worn  or  are  not  worn  properly  —  e.g.  sleeves  rolled  up,  improper  gloves, 
gloves  excessively  worn,  no  gloves  worn,  etc. 

ELECTROSTATIC  DISCHARGE  IGNITION  SCENARIOS  (1.17/year) 

Three  categories  of  electrostatic  discharge  (ESD)  initiation  scenarios 
were  calculated  to  have  relatively  high  probabilities  of  occurrence: 

1.  Operator  Charged  Outside  of  Building  1.17/year 

Due  to  Dry  Concrete  Pad 

-4 

2.  Operator  Charged  due  to  Improper  Clothing/Shoes  5.46  X  10  /year 

3.  Ungrounded  equipment  (e.g.  mine  car,  forklift,  _4 

jib  crane  2.42  X  10  /year 

By  far  the  most  dominant  of  these  scenarios  is  an  operator  becoming 
charged  outside  the  building  while  working  on  the  concrete  pad.  Unless  the 
concrete  is  moist  from  rains  or  manual  washdown,  it  will  have  a  fairly  low 
electrical  conductivity.  Electric  charge  that  an  operator  picks  up  while 
working  in  the  area  will  not  drain  off  back  to  ground  readily  even  if  he  is 
wearing  grounded  shoes.  This  problem  was  recognized  in  the  design  of  WADF, 
as  evidenced  by  the  grounding  bars  that  personnel  are  supposed  to  grab  as  they 
enter  each  building.  Outside  the  Flashing  Chamber  Building  the  concrete  pad 
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is  not  grounded  and  ESD  from  an  operator  is  possible.  Since  the  operator  is 
handling  contaminated  items,  the  contamination  could  become  ignited  by  a  dis- 


charge  from  the  operator. 

Fault  Tree 
Component  No. 

Descri ption 

Probability/ 
Frequency  Used 

121 

Flashing  Operation  being  Setup 

0.75/hour 

164 

Prolonged  Dry  Period  Causes  Concrete 
to  become  low  conductivity* 

0.2 

166 

Manual  Wetting  of  Pad  is  not  kept  up 
(Not  Part  of  Procedure) 

1.0 

167 

Operator  Becomes  Charged 

1.0 

168 

Operator  Discharges  Exposed  Explosive  in 
Item  (based  on  configuration) 

0.25 

169 

ESD  Causes  Initiation  of  Item 

0.1 

76 

Resultant  Fire  Injures  Operator  or 

Damages  Equipment 

0.05 

*Fraction 

of  vear  with  prolonged  dry  periods 

If  manual  wetting  of  the  concrete  pad  is  incorporated  as  part  of  the  pro¬ 
cedure,  the  estimated  probability  of  this  event  can  be  reduced  by  at  least  2 
or  3  orders  of  magnitude,  i.e.  to  about  10“2  to  10~3  per  year  (human  error 
probability).  It  also  should  be  noted  that  component  76  (that  an  initiation 
results  in  a  serious  outcome)  is  probably  overly  conservative  at  1  in  20. 


CAMERA  INSIDE  CHAMBER  RUINED  DURING  FLASHING  (0.469/year) 


The  camera  inside  the  flashing  chamber  could  be  ruined  during  a  burn  if 
cooling  to  the  camera  is  lost.  Cooling  can  be  lost  by  a  controller  error  or 
due  to  mechanical  failure  of  the  cooling  system.  A  typical  scenario  in  this 
category  is  summarized  below: 


Fault  Tree 
Component  No. 

2 

36 

37 


Descripti on 

-lashing  Operation  Frequency 

Controller  Fails  to  Start  Coolant  Flow 

Controller  does  not  notice  coolant  flow 
is  off  (some  common  cause  with  Component  36) 

Camera  is  ruined  due  to  lack  of  cooling 


Probability/ 
Frequency  Used 

0.75/hour 

0.003 

0.1 


35 


1.0 


‘  [TOTAL  IMPACT  SCENARIOS  (7.9  X  10~2/year) 

Several  local  impact  initiation  hazards  were  identified  in  the  analysis. 

The  first  of  these  involved  unbumed  smokeless  powder  or  explosive  (remaining 
on  a  mine  car  from  a  previous  flashing  operation)  being  initiated  while  raking 
out  the  mine  car  sand  bed.  This  scenario  had  an  estimated  probability  of 
7.8  X  ICf4  per  year.  Contamination  could  remain  in  the  sand  bed,  for  example, 
if  propellant  grains  or  explosive  fallen  out  of  an  item  is  inadvertently 
buried  in  the  sand  during  setup.  The  sand  could  then  insulate  the  contamination 
during  flashing  and  prevent  ignition.  Then  while  raking  out  the  sand  bed  in 
preparation  for  the  next  operation,  the  contamination  could  be  ignited  by  impact 
from  the  rake  onto  the  metal  bottom  of  the  mine  car.  Most  likely  such  an 
initiation  would  involve  only  a  small  amount  of  energetic  material,  but  there 
is  a  finite  probability  that  an  injury  or  damage  to  the  mine  car  could  result. 


Fault  Tree 

Probability/ 

Component  No. 

Description 

Frequency  Used 

2 

Flashing  Operation  Frequency 

0.75/hour 

185 

Excessive  Contamination  Remains  in  Mine 

Car  After  Flashing 

0.01 

186 

Metal  Rake  is  used  to  clean/smooth 
sand  in  mine  car 

1.0 

187 

Rake  impacts  exposed  contaminated 
metal 

0.01 

188 

Impact  causes  initiation 

1.0 

189 

Reaction  Propagates  to  Bulk  of  Contamination  0.1 

Present 

76 

Resultant  Fire  Injures  Operator  or  Damages 

0.05 

or  Damages  Equipment 

The  second  category  of  local  impact  scenarios  involves  contamination  on 
couplers  between  mine  cars  or  DLT  carts  being  initiated  by  impact.  In  this 
case  it  is  quite  unlikely  that  more  than  a  spark  would  be  produced,  but  the 
spark  could  in  turn  ignite  contamination  in  items  on  smokeless  powder  layed 
for  flashing  on  a  mine  car.  Injury  to  a  nearby  operator  or  damage  to  equipment 
is  then  possible.  This  category  of  scenarios  has  an  estimated  probability  of 
about  5.85  X  10"4  per  year. 
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Faul  t  Tree 
Component  No. 

196 

203 

204 

205 

206 
207 

41 


Probability/ 

Description  Frequency  Used 

Powder  is  being  Layed  in  Preparation  0.75/hour 

for  Flashing 

Couplers  between  mine  cars  carrying  items  0.05 

become  contaminated 

Impacts  from  start/stop  of  mine  cars  ignites  1.0 
ignites  contamination 

Smokeless  powder  is  layed  in  items  and  on  1.0 
mine  cars 

Reaction  Spreads  to  Smokeless  Powder  on  0.001 

Mine  Car 

Resultant  Fire  Injures  Operator  or  Damages  0o2 
Equipment 

Detection/Deluge  is  ineffective  to  0.03 

protect  equipment 


The  third  category  of  scenarios  involve  the  air  hose  used  to  power  the 
mine  cars  being  inadvertently  reeled  in  causing  the  metal  quick  connect  to 
impact  contaminated  items  and/or  smokeless  powder  layed  on  a  mine  car  prepared 
for  flashing.  There  are  several  locations  on  the  track  loop  where  it  may  be 
most  convenient  to  use  a  hose  with  the  reel  in  front  of  the  car  being  moved, 
i.e.  the  hose  must  be  pulled  past  the  mine  car  in  order  to  make  the  connection. 
The  hose  could  be  inadvertently  reeled  in  and  slip  out  of  the  operator's  hand 
while  he  is  trying  to  make  the  connection.  The  hose  probably  will  be  layed  to 
the  side  of  the  mine  car  in  these  cases,  but  could  be  stretched  across  the  car 
by  mistake.  Even  if  the  hose  is  stretched  next  to  a  car  it  could  flip  up  onto 
a  car  as  it  is  being  reeled  in.  An  impact  initiation  on  a  mine  car  layed  with 
powder  with  an  operation  present  is  likely  to  result  in  a  serious  injury.  This 
group  of  scenarios  was  estimated  to  have  a  probability  of  occurrence  of 
3.35  X  l(f4/year. 


Fault  Tree 

Probability/ 

Component  No. 

Description 

Frequency  Used 

196 

Powder  is  being  Layed  in  Preparation 
for  Flashing 

0.75/hour 

349 

Air  hose  is  stretched  across  loaded  mine 
car  (human  error — should  be  stretched  to 
side  of  car) 

0.01 
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Fault  Tree 
Component  No. 

Description 

Probability/ 
Frequency  Used 

350 

Rewind  mechanism  is  activated  before 
quick  connect  is  made,  and  hose  gets 
pulled  from  operator's  hands 

0.01 

351 

Metal  Connection  impacts  propellant  or 
contamination  on  mine  car 

1.0 

352 

Release  occurs  before  powder  is  layed 

0.5 

353 

Impact  ignites  contamination 

0.2 

354 

A  significant  amount  of  energetic 
material  becomes  involved 

0.1 

197 

Resultant  fire  injures  operator  or 
damages  equipment 

0.2 

The  last  category  of  local  impact  scenarios  involve  contamination 
remaining  in  the  sand  bed  of  a  nine  car  as  discussed  above  in  the  raking 
scenarios.  However,  in  this  case,  the  sand  bed  has  not  been  raked  out  ade¬ 
quately,  and  an  item  being  positioned  on  the  car  impacts  an  exposed  area  not 
protected  by  sand.  The  impact  causes  initiation  of  contamination  remaining 
in  the  sand  bed  or  fallen  out  of  the  contaminated  item  prior  to  the  impact. 
The  reaction  then  must  propagate,  e<,g.  to  involve  contamination  in  the  item, 
in  order  for  significant  damage  or  an  injury  to  result.  The  probability  of 
occurrence  for  this  scenario  is  estimated  to  be  3.9  X  10  ^  per  year. 


Fault  Tree 

Probabi 1 i ty/ 

Component  No. 

Description 

Frequency  Used 

2 

Flashing  Operation  Frequency 

0.75/hour 

180 

Contamination  is  not  removed  from  sand  bed. 
A  significant  amount  remains. 

0.01 

181 

Sand  bed  is  not  leveled  prior  to  movement 
of  next  items  to  mine  car 

0.01 

182 

During  item  transfer  to  car,  item  impacts 
at  exposed  contaminated  metal  bottom  of 
mine  car* 

.05 

183 

Impact  causes  initiation 

1.0 

184 

Reaction  propagates  to  contaminant  in  item 

0.1 

76 

Resultant  fire  injures  operator  or 
damages  equipment 

0.05 

*  Geometry  factor,  conservative  value  used. 
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TTFM/ CONTAINER  IMPACT  SCENARIOS  (5.39  X  10“Z/yearJ__ 

A 

number  of  scenarios  were  identified  in  which  a  contaminated  item  or  a 

smokeless  powder  container  falls  or  is  moved  into  a  fixed  object 
initiation  by  impact.  These  include: 

causing 

• 

mine  car  impacts  bump  post  causing  braced  items 
to  fall 

3.12  X  10"2/yr 

• 

items  or  containers  fall  off  DLT  due  to  emergency 
braking  or  rough  handling  of  container 

7.8  X  10  /yr 

• 

item  or  container  dropped  by  jib  crane 

5.0  X  10  /yr 

O 

• 

DLT  backed  into  wall  or  fixed  object 

3.9  X  10  /yr 

• 

forklift  driven  into  smokeless  powder  container  or 
contaminated  item 

4.04  X  10  /yr 

O 

• 

item  falls  due  to  inadequate  bracing  on  mine  car 

1.3  X  10  /yr 

• 

mine  car  impacts  closed  chamber  door 

4.4  X  10  vyr 

c 

• 

item  falls  off  mine  car  due  to  hand  braking 

9.36  X  10  Vyr 

• 

smokeless  powder  container  falls  out  of  dumper 
clamping  fixture  due  to  gross  misalignment  of 
container  by  operator 

9.36  X  10”5/yr 

A  typical  scenario  is  outlined  below: 

Fault  Tree 

Component  No.  Description 

Probabi 1 i ty/ 
Frequency  Used 

2 

Flashing  operation  frequency 

0.75/yr 

117 

Rough  handling/hand  braking  of  DLT  Cart 

0.01 

118 

Cart  dumps  items  due  to  the  quick 
deceleration 

0.2* 

119 

Items,  impact  rigid  surface 

1.0 

120 

Impact  causes  initiation 

0.05** 

76 

Resultant  fire  injures  operator 
or  damages  equipment 

0.05 

♦Calculations  indicate  that  hand  braking  will  cause  tall  stacks  to 
fall  but  short  stacks  will  not  be  affected.  It  was  judged  that 
20  percent  of  the  time  high  stacks  or  items  lined  up  sitting  on 
their  tails  will  be  used  and  80  percent  of  the  time  stable  arrange¬ 
ments  (e.g.  items  on  their  sides)  will  be  used. 

♦♦Based  on  the  geometry  of  where  contaminant  would  be  exposed  and 
a  probability  of  0.1  for  propagation. 
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"OPERATOR  INJURY  DUE  TO  USE  OF  NONELECTRIC  POWDER  TRAIN  (4.68  X  10~2/,year) 

To  ignite  the  smokeless  powder  in  the  flashing  chamber,  two  general 

alternatives  exist:  1)  remote  electrical  initiation  and  2)  nonelectrical 

initiation  of  a  powder  train,,  As  discussed  in  the  Batelle  report  (reference  1) 

squibs  or  other  devices  containing  sensitive  energetic  materials  susceptible 

to  ESD  initiation  are  not  desireable  and  should  not  be  used  for  remote  electrical 

initiation.  A  purely  electrical  element  appears  to  be  the  most  desireable 

option.  Use  of  a  nonelectrical  powder  train  is  potentially  hazardous  in  several 

respects.  First,  the  most  convenient  ignition  source  .would  appear  to  be 

a  match  or  cigarette  lighter.  However,  having  such  materials  in  an  area 

where  contaminated  items  and  smokeless  powder  are  present  is  a  hazardous 

practice  and  should  not  be  allowed.  Chemical  initiation  (mixing  two  separated 

chemicals)  may  be  somewhat  safer  but  is  a  less  common  practice  and  not  as 

convenient.  Chemical  initiation  could  impose  its  own  hazards  in  that  one 

of  the  chemicals  being  mixed  could  be  an  acid.  In  either  case,  if  the 

% 

operator  cannot  get  away  to  a  safe  area  quickly  enough,  he  could  be  serious¬ 
ly  injured.  The  escape  of  the  operator  would  be  at  risk  if  the  powder 
train  is  set  too  short,  if  it  is  inadvertently  ignited  too  close  to  the  items 
on  the  mine  cars,  or  if  the  operator  slips  or  trips  as  he  is  leaving  and 
becomes  injured  to  the  point  that  he  cannot  escape  (e.g.  hits  his  head  and 

gets  knocked  out).  It  was  estimated  that  the  probability  of  occurrence  for 

_2 

this  category  of  hazards  is  4»68  X  10  per  year. 


^  v/ 

Fault  Tree 

Probability/ 

Component  No. 

Description 

Frequency  Used 

371 

Nonelectric  ignition  of  powder  train 

0.375/hour 

374 

is  used  (assumed  to  be  used  half  the 
time) . 

Operator  slips/trips  upon  exit  and 

0.001 

375 

cannot  escape 

Fire  seriously  injures  operator 

0.05 
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The  flashing  chamber  has  been  designed  to  contain  the  blast  of  a  120  pound 
TNT  equivalent  line  charge  distributed  along  the  axis  of  the  chamber,  but  such 
an  explosion  could  do  significant  damage  to  the  chamber  and  make  it  unuseable 
for  further  flashing..  The  blast  of  a  10  pound  TNT  equivalent  internal  explosion 
can  be  contained  without  damaging  the  chamber.  In  the  analysis  of  the  flashing 
chamber  an  explosion  involving  more  than  10  pounds  of  TNT  equivalent  was  taken 
as  the  criteria  for  significant  damage  to  the  chamber.  Several  scenarios  were 
identified  leading  to  such  an  event: 

t  explosion  due  to  excessive  propellant  packed  into  _2 

the  item  1,56  X  10  /year 

•  explosion  due  to  excess  explosive  contamination  _g 

left  in  item  during  flashing  1«56  X  10  /year 

•  explosion  due  to  mis taken/mis routed  waste  explosive  _4 

used  in  lieu  of  smokeless  powder  for  flashing  6.24  X  10  /year 

(inexperienced  operators  or  gross  negligence) 

A  typical  scenario  is  described  in  the  table  below. 

Fault  Tree  Probability/ 

Component  No.  Description  Frequency  Used 


2 

Flashing  Operation  Frequency 

0.75/hr 

3 

Steamout  process  is  incomplete 

0.01 

4 

Inspections  do  not  reveal  excess  amounts 
of  explosive* 

0.001 

5 

Greater  than  10  pounds  of  explosives 
left  in  the  items  to  be  decontaminated 

0.1 

6 

Sufficient  depth  and  extent  of  explosive 
exist  making  detaonation  possible 

1.0** 

7 

Sufficient  confinement  exists  for 
detonation 

1.0** 

1 

Explosion  result  in  severe  damage  to 
the  chamber  (a  certainty,  given  that 

5,  6  and  7  occur) 

1.0 

*  This  represents  two  inspection  errors,  but  with  some  common  cause 
involved.  For  example,  the  large  amount  of  left  over  explosive 
may  be  hidden  behind  a  pipe  and  missed  in  the  same  way  by  both 
operators  inspecting  the  item. 

**  The  conservative  extreme  values  were  used  here. 
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.GONDOLA  INCIDENTS  (1.067  X  10~3/year) 


Train  derailments  and  collisions  occur  at  a  fairly  steady  rate  across 
the  country  each  year  primarily  in  switch  yards  and  other  locations  where 
trains  are  maneuvered.  Such  incidents  are  relevant  at  the  flashing  furnace 
because  trains  must  travel  deep  into  the  plant  to  remove  the  scrap  metal. 
Statistics  for  train  accidents  can  be  obtained  from  the  U.S.  Department  of 
Transportation,  Federal  Railroad  Administration,  Office  of  Safety,"  Accident/ 
Incident  Bulletins  and  other  relevant  data  (e.g.  train-miles  travelled  each 
year)  can  be  obtained  from  the  Association  of  American  Railroads  Yearbook  of 
Railroad  facts.  Based  on  these  references,  it  is  estimated  that  about  2.49  X 
10"8  collisions  and  1.62  X  10‘8  derailments  occur  per  train  car  mile  each  year. 
A  factor  of  100  can  be  applied  to  these  rates  to  account  for  switchyard  and 
similar  operations  having  a  higher  rate  than  straight  track.  It  is  estimated 
that  about  0.125  train  car  miles  will  be  travelled  per  hour  on  the  flashing 
furnace  spur  (based  on  one  train  trip  in  and  out  of  the  plant  per  day  over 
about  a  1/2  mile  track  section).  Thus,  on  the  flashing  chamber  spur,  it  is 
expected  that  about  6.47  X  10"4  collisions  and  4.2  X  10"4  derailments  will 
occur  per  year. 

OPERATOR  BURNED  ON  HOT  ITEM  OR  MINE  CAR  (1.56  X  10~3/,year) 


Several  scenarios  were  identified  in  which  an  operator  is  seriously 
burned  on  the  hot  metal  of  decontaminated  items  or  the  mine  car  because  of 
handling  the  items  before  they  are  given  sufficient  time  to  cool  off.  A 
typical  scenario  is  outlined  below: 


Fault  Tree 
Component  No. 

392 

394 

395 

396 

397 

398 


Probability/ 

Description  Frequency  Used 

Flashing  is  completed  0. 75/hr 

Items  are  not  allowed  a  long  enough  0.01 

time  to  cool  in  cool -off  area 

Operator  does  not  sense  high  temperature  0.01 

Operator  not  wearing  protective  clothing  0.01 

Operator  contacts  hot  metal  with  skin  1.0 

Contact  results  in  skin  burn  1.0 
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OTHER  HAZARD  SCENARIOS 

Several  other  scenarios  were  identified  for  the  flashing  chamber  operation, 
but  were  of  lesser  significance.  These  include  (1)  initiation  due  to  contamina¬ 
tion  on  bolt  threads  while  changing  the  container  dumper  fixtures  for  Type  III 
and  MK7  containers  (1.12  X  10"4/year),  (2)  initiation  due  to  smoking  in  the 
area  (7.8  X  10”5/year),  (3)  baghouse  damage  due  to  an  explosion  in  the 
flashing  chamber  along  with  failure  of  the  pressure  relief  vent  at  the  regenera¬ 
tor  (4C47  X  10‘5/year)  and  (4)  operator  injury  or  death  due  to  an  operator 
getting  locked  in  the  chamber  during  flashing  (5.62  X  10"5/year).  This  last 
category  of  scenarios  involves  one  operator  being  injured  (e.g.  temporarily 
knocked  out  or  intoxicated)  while  in  the  chamber,  and  a  second  operator  not 
noticing  this  and  closing  the  chamber  door  on  him.  This  scenario  requires 
several  human  errors  (i.e.  the  original  incapacitation  error,  closing  the 
door,  controller  not  noticing  on  the  video  and  a  head  count  not  taken  at  the 
Decontamination  Building),  but  it  is  possible  that  someone  could  be  closed  in 
the  chamber  and  not  get  oriented  quick  enough  to  escape  in  time. 

3.5  DRIVERLESS  TRACTOR  SYSTEM,  OFFLOADING  DOCK,  AND  MAGAZINES 

The  fault  tree  analysis  for  the  DLT  System,  Off  Loading  Dock  and  Magazines 
was  quite  voluminous,  considering  specific  DLT  operations  for  each  process 
building  independently.  However,  very  little  that  is  new  was  uncovered  in  the 
analysis.  Almost  all  of  the  dominant  scenarios  involved  hazards  that  have 
already  been  discussed  for  the  specific  process  building  involved.  These  in¬ 
cluded  initiation  of  items  or  containers  falling  off  of  a  DLT  cart  due  to  hard 
braking  or  initiation  due  to  a  cart  being  backed  into  a  wall  or  fixed  object, 
or  initiation  due  to  a  DLT  or  other  vehicle  (e.g.  a  forklift  or  Flashing 
Chamber  Car)  riding  over  a  contaminated  surface  and  initiating  the  contamina¬ 
tion  by  pinch  or  friction. 

The  only  new  scenario  of  importance  involving  this  system  is  at  the 
Offloading  Dock.  It  was  estimated  that  an  operator  would  become  seriously 
injured  while  unloading  a  freight  train  boxcar  with  a  probability  of  0.52  per 
year.  This  scenario  involves  items  in  the  boxcar  shifting  during  transport, 
ready  to  fall  out  of  the  door  upon  opening.  The  unaware  operator  is  then 
injured  as  the  items/packages  fall  onto  him  upon  opening  the  door  of  the  boxcar. 
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Fault'Tree 

Component  No.  Description 


Probability/ 
Frequency  Used 


813 

Freight  car  is  fully  loaded  at  off¬ 
loading  dock 

0.167/hr 

814 

Load  has  shifted  in  car  during  transit 

0.01 

815 

Worker  is  unaware  of  shifted  load 

1 .0 

816 

Operator  opens  door  of  freight  car 

1 .0 

817 

As  door  is  opened,  items/containers  fall 
out 

0.1 

818 

Worker  cannot  get  out  of  the  way  in 
time 

0.1 

819 

Worker  is  severely  injured  by  falling 
items/containers 

0.5 

It  is  also  worth  mentioning  here  that  in  the  course  of  the  study  of  the  DLT 
system  it  was  discovered  that  type  EE  tractors  were  purchased  for  WADF,  whereas 
type  EX  were  specified  initially.  Type  EX  certainly  would  have  been  the  more 
conservative  choice*  although  the  requirements  are  somewhat  borderline  in  many 
of  the  areas  at  WADF.  This  is  discussed  further  in  the  Recommendations  and 
Conclusions  section. 
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4.  RECOMMENDATIONS  AND  CONCLUSIONS 


In  this  section,  the  recommendations  and  conclusions  resulting  from  the 
Priority  3  hazards  analyses  are  consolidated.  They  are  presented  for  each  area 
of  the  facility  that  was  evaluated  under  Priority  3  and  have  been  prioritized 
using  descriptive  terms  such  as  (in  decreasing  order  of  urgency)  "strongly 
recommended",  "recommended",  "suggested/good  practice",  and  "concluded". 

General  recommendations  that  apply  to  more  than  one  area  are  presented 
separately  at  the  end  of  the  section. 


4.1  ROTARY  FURNACES  IN  THE  DECONTAMINATION  BUILDING 

•  By  far  the  majority  of  problem  areas  that  were  identified  will 
result  in  lost  production  and  not  a  major  hazard. 

•  The  potential  hazard  with  by  far  the  greatest  consequence  is  that 
of  the  truck  driver  hitting  the  nearby  unprotected  propane  tank 
while  moving  the  scrap  metal  recovery  trailer.  It  is  recommended 
that  strategically  located  posts  similar  to  those  protecting  the 
lightning  poles  be  positioned  around  the  propane  tank.  Proper, 
placement  of  such  posts  would  still  allow  easy  access  for  filling 
the  tank.  An  alternate  approach  would  be  to  relocate  the  propane 
tank. 


4.2  TRAY  TYPE  FLASHING  FURNACE  IN  THE  DECONTAMINATION  BUILDING 

•  Strict  controls  must  be  enforced  to  assure  that. inspection 
procedures  are  accompTTshed  with  care  so  that  filled  or  partially 
filled  items  are  not  put  into  the  tray  type  furnace. 

•  It  is  recommended  that  a  deluge  type  sprinkler  system  be  installed 
in  the  baghouses  at  the  Decontamination  Building. 


4.3  LARGE  ITEMS  FLASHING  CHAMBER 

•  It  is  strongly  recommended  that  detailed  inspections  be  carried 
out  on  decontaminated  items  processed  in  the  Flashing  Chamber. 

The  items  should  be  disassembled  and  or  sectioned  so  that  bolt 
threads  and  other  tight  areas  can  be  observed  to  assure  that 
contamination  does  not  remain  after  flashing  is  completed.  Since 
"flashing"  is  a  short  duration  high  temperature  exposure  it  is 
quite  likely  that  the  heat  will  not  have  time  to  penetrate  to 
all  of  the  interior  contaminated  rigions  of  an  item.  This  type 
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of  inspection  procedure  should  be  accomplished  until  a  reasonable 
data  base  has  been  developed  to  assure  that  decontamination  by 
flashing  does  indeed  work  and  is  reliable.  It  should  be  noted 
that  visual  inspection  of  a  treated  item  will  not  necessarily 
assure  adequacy  of  decontamination.  Cracks,  threaded  areas,  and 
sub-surface  cavities  or  flaws  can  still  iiouse  hidden  and  undetect¬ 
able  explosive  material. 


•  Raking  of  the  sand  beds  on  the  mine  cars  should  be  carried  out 
with  care  for  each  flashing  cycle  to  assure  that  very  little 
contamination  remains  in  the  sand  and  that  a  cushion  is  present 
to  prevent  direct  metal  -  metal  contact.  It  is  recommended 
that  non-metal  rakes  be  used  for  this  purpose  to  minimize  the 
possibility  of  impact  initiation  of  contamination  that  remains 
on  the  mine  car. 

•  It  is  recommended  that  the  concrete  pad  outside  the  flashing 
chamber  be  periodically  wetted  down  to  minimize  the  possibility 
of  electrostatic  discharge  from  operators  or  equipment  as  con¬ 
taminated  items  are  handled  in  this  area. 

•  It  is  strongly  recommended  that  remote  purely  electrical  ignitors  be 
used  to  initiate  the  burns  in  the  Flashing  Chamber.  Squibs 

or  other  ignitors  that  contain  explosives  that  are  sensitive 
to  ESD  are  undesirable  because  of  the  potential  for  premature 
initiation.  Use  of  a  powder  train  is  undesireable  due  to  the 
possibility  that  the  operator  could  inadvertently  light  the 
powder  train  too  close  to  the  items,  or  not  set  up  a  long  enough 
powder  train,  or  become  injured  on  his  way  out  and  not  be  able 
to  escape  in  time. 

•  It  is  recommended  that  reliable  non-combustible  bracings  be 
designed  for  each  type  of  item  to  be  decontaminated  in  the 
Flashing  Chamber.  "Hake-shift"  arrangements  should  not  be  used 
because  of  the  high  potential  for  the  bracing  to  collapse  and 
items  to  fall.  The  smokeless  powder  and/or  contamination  could 
become  ignited  from  the  impact  in  such  an  event. 

•  It  is  recommended  that  operators  at  the  Flashing  Chamber  be 
trained  to  know  what  all  possible  smokeless  powders  to  be  used 
will  look  like.  Any  material  that  does  not  fit  this  pattern 
should  not  be  used  in  any  event.  For  example,  flakes,  chips, 

or  small  pieces,  etc.  could  be  explosive  misrouted  and  actually 
intended  for  processing  in  the  Bulk  Incinerator.  Packing  items 
on  a  flashing  car  with  such  a  material  could  result  in  a  major 
explosion  inside  the  chamber. 
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t**It  is  recommended  that  driverless  tractor  loads  be  positioned 
with  the  lowest  possible  center  of  mass.  This  will  minimize  the 
chance  for  the  load  falling  off  of  the  carts  in  the  event  of  a 
fast  stop. 

•  The  driverless  tractor  system  that  has  been  installed  at  WADF 
is  rated  as  EE  type  equipment,  rather  than  EX  as  was  required 
in  the  specifications  for  the  DLT.  According  to  AMCR385-100, 
these  two  classifications  for  battery  powered  equipment  can  be 
used  as  follows: 

"Type  EX  equipment  is  approved  for  use  in  Class  1  Group  D  and 
Class  II  Group  G  hazardous  locations."  "Equipment  used  in 
atmospheres  containing  explosives  dusts,  flammable  vapors  or 
flammable  gases,  must  meet  requirements  for  EX  industrial 
trucks. " 

"Type  EE  industrial  trucks  are  satisfactory  for  handling  all 
classes  of  ammunition  and  explosives  packed  in  accordance  with 
Department  of  Transportation  Regulations.  Type  EE  industrial 
trucks  may  be  used  for  handling  partially  loaded  ammunition  in 
corridors  or  ramps  connecting  hazardous  operations,  providing 
the  ramps  and  corridors  are  not  Class  I  or  Class  II  hazardous 
locations  as  defined  in  paragraph  6-3f.  Type  EE  equipment  shall 
not  be  used  in  Class  I  or  Class  II  hazardous  locations." 

Use  of  Type  EE  equipment  in  some  buildings  at  WADF  appears  to  be 
borderline  at  best.  The  Type  EE  DLT  should  not  be  used  in  any  areas  where 
explosive  dust  or  flammable  vapors  may  De  present. 

•  The  highest  probability  scenario  in  the  DLT/Offloading  Dock/ 

Magazine  category  was  that  of  items/containers  falling  out  of 
a  railroad  boxcar  onto  an  operator  when  the  boxcar  door  is 
opened.  This  could  happen  if  the  load  is  not  properly  tied  down 
and  shifts  during  transit.  Great  cans  should  be  exercised  by 
the  operators  to  carefully  open  the  boxcar  doors  to  assure  that 
the  load  is  not  in  a  tenuous  position.  To  guard  against 
operator  injury  from  falling  loads  resulting  from  shifted 
cargo,  it  is  recommended  that  a  come-along  be  used  to  open 
box-car  doors.  The  operator,  then  is  more  likely  to  be 
removed  from  the  door  opening  area. 


4.5  AIR  BLAST  PROTECTION  FROM  AN  EXPLOSION  IN  A  CELL 

The  adequacy  of  protection  from  air  blast  was  evaluated  under  this  project 
and  is  discussed  in  Appendix  B.  Conclusions  of  that  study  are  repeated  here: 

•  Pressures  transmitted  to  the  corridor  due  to  the  "piston  action" 
of  a  cell  door  were  determined  to  be  reasonably  low,  but  on  the 
order  of  the  2.3  psig  criteria  for  safety  adequacy. 
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t  Pressures  transmitted  to  the  corridor  due  to  leakage  around  the 

’'edges  of  the  cell  door  were  determined  to  be  quite  high  in  many 
cases  and  up  to  about  42  psig  in  one  instance.  Therefore,  it  is 
expected  that  unacceptably  high  pressures  are  possible  locally 
close  to  the  cell  doors  in  the  event  of  the  explosion  of  a  maxi¬ 
mum  or  nominal  quantity  of  explosive  detonating  in  several  of  the 
cell s . 

•  At  the  mechanical  room  for  the  Bulk  Incinerator  Building,  a 

ventilation  duct  provides  a  fairly  direct  route  for  air  blast  to 
channel  into  the  mechanical  room.  Calculations  showed  that  the 
average  pressure  in  the  mechanical  room  would  be  quite  low,  but 
locally  at  the  entrance  to  the  duct  the  pressures  could  exceed  the 
2.3  psi  criteria  significantly  if  a  maximum  sized  explosion  occurs 
in  the  process  area  of  the  Bulk  Incinerator  Building.  Because  the 
traffic  flow  pattern  for  personnel  in  the  control  room/mechanical 
room  is  likely  to  have  personnel  in  the  vicinity  of  the  ducts,  a 
severe  injury  could  occur  in  the  event  of  an  explosion.  It  should 
be  noted  that  the  probabilistic  analysis  indicated  that  such  an 
explosion  would  be  quite  unlikely,  and  the  low  probability  should 
be  considered  in  deciding  whether  corrective  action  is  warranted 
in  this  case. 


4.6  GENERAL  RECOMMENDATIONS  FOR  THE  PRIORITY  3  SYSTEMS 

Many  of  the  general  recommendations  presented  for  the  Priority  1  and  2 
Systems  are  pertinent  here  also.  These  recommendations  are  repeated  below: 

•  Every  operation  on  every  equipment  item  must  be  covered  by  a 
written  procedure,  reviewed  and  approved  by  operating  and 
safety  management  personnel . 

•  A  comprehensive  training  program  should  be  required  for  all 
plant  personnel,  including  information  on  potential  hazards. 

•  All  equipment  operators  should  be  given  appropriate  training 

'  courses  and  certified  or  licensed  for  operations  in  which  they 

will  be  involved. 

•  All  plant  personnel  should  be  tested  for  electrical  grounding 
of  footgear  at  least  once  a  day  with  a  sign-in  sheet. 

•  Frequent  cleanup  of  each  plant  area  is  mandatory  to  prevent 
buildup  of  contamination.  Such  cleanups  should  be  scheduled 
as  part  of  the  operating  procedures  for  each  area. 

•  Area  surfaces  should  be  kept  wet  during  maintenance  as  part 

of  the  procedure.  The  equipment  should  be  thoroughly  cleaned/ 
decontaminated  prior  to  any  maintenance  operation. 

•  It  is  recommended  that  a  2  locker  system  be  adopted  for  plant 
personnel.  One  locker  should  be  for  street  clothes  and  a 
second  locker  for  work  clothes.  All  clothing  should  be  changed 
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•  * -at  the  beginning  and  end  of  the  shift.  Clothing  should  be 

supplied  by  the  plant  -  nothing  taken  hone.  A  shower  should 
be  taken  enroute  from  taking  off  work  clothes  to  putting  on 
street  clothes.  This  procedure  will  also  help  avoid  street 
shoes  being  mistakenly  worn  in  the  plant  areas. 

'•  An  area  entry  and  hot  work  permit  program  should  be  set  up 

to  assure  that  all  temporary  repairs  and  maintenance  operations 
are  well  thought  out  and  accomplished  with  several  levels  of 
safety  and  management  checks. 

•  During  maintenance,  tools  should  be  connected  to  the  workmen 
by  a  cord  wherever  practical  to  help  break  the  fall  of  the 
tool  if  it  is  dropped. 

•  Strict  cleanliness  must  be  enforced  at  all  times  in  the  plant, 
particularly  when  personnel  leave  contaminated  areas  to  go  to 
lunch  or  at  the  end  of  the  shift.  Nothing  should  be  eaten  in 
the  work  area.  No  food  should  be  allowed  in  the  work  area. 

•  A  medical  surveillance  program  should  be  set  up  to  screen 
personnel  for  specific  jobs  at  hiring  and  to  assure  that  long 
term  health  damage  is  avoided. 

•  Any  major  system  modifications  made  in  the  future  should  be 
safety  analyzed  upon  completion  of  their  design. 
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APPENDIX  A  HAZARDS  ANALYSIS  APPROACH 


Basically,  the  following  steps  were  used  in  the  analyses: 

a)  Collect  Available  Information 

b)  Review  Information/Learn  System 

c)  Conduct  an  Informal  Failure  Modes  and  Effects  Analysis  ( FMEA) 

d)  Develop  Fault  Tree  Logic  Diagrams  for  System  (FTA) 

e)  Quantify  Fault  Tree  (derive  scenario  probabilities) 

f)  Interpret  and  Summarize  the  FTA  Results 

For  the  purposes  of  this  program,  the  failure  modes  and  effects  analyses  served 
to  identify  types  of  consequences  and  types  of  scenarios  to  be  expected  in 
different  areas  of  the  WADF.  The  FMEA 1 s  were  used  to  learn  the  system  and  guide 
the  development  of  the  fault  trees.  Fault  tree  analysis  was  the  primary 
methodology  used  to  identify  and  quantify  credible  hazards  at  the  facility. 

The  FMEA  and  Fault  Tree  methods  are  described  below: 

A.l.  FAILURE  MODES  AND  EFFECTS  ANALYSIS  (FMEA) 

Failure  Modes  and  Effects  Analysis  is  a  relatively  simple  and  direct 
approach  for  identifying  basic  sources  of  failure  and  their  consequences.  This 
method  is  not  rigid  and  can  be  used  for  widely  differing  applications.  It  is 
especially  applicable  for  identifying  sources  of  malfunctions  in  hardware 
systems  or  in  process  equipment.  The  primary  purpose  of  the  analysis  is  to 
identify  and  remove  failures  that  can  cause  hazards.  However,  as  a  side 
benefit,  the  analysis  also  leads  to  the  identification  of  failures  that  are 
in  themselves  not  hazardous  but  might  affect  the  reliability  of  the  functioning 
of  a  system.  The  results  of  such  an  analysis  also  may  serve  as  an  input  to 
a  Fault  Tree  Analysis,  although  more  generally  the  two  methods  are  used 
independently. 

A  Failure  Modes  and  Effects  Analysis  is  carried  out  by  filling  in  a  table 
having  column  headings  such  as  the  ones  shown  in  Figure  Al.  This  format  is 

the  one  used  for  the  Priority  1  systems.  The  first  two  columns  list  the 
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systenvparts  and  procedure  steps  obtained  from  the  available  drawings,  written 
descriptions,  etc.  The  third  column  is  used  to  identify  the  different  possible 
failure  modes  for  each  entry  listed  in  the  previous  columns.  There  may  be 
several  entries  in  column  3  for  each  system  part  or  task.  Given  these  initial 
failures,  the  possible  chains  of  events  were  described  in  the  next  column, 
and  the  ultimate  effect  on  the  system  was  given  in  the  last  column.  The 
Priority  1  FMEA  tables  were  relatively  formal  and  time  consuming  to  produce. 
These  tables  were  used  primarily  as  "shopping  lists"  for  fault  tree  development, 
a  function  not  necessitating  the  formal  presentation.  In  Priority  2  and  3 
analyses  a  less  formal  FMEA  presentation  is  being  utilized,  although  this  method 
is  still  used  to  provide  the  basis  for  fault  tree  diagramming. 

A. 2.  FAULT  TREE  ANALYSIS 

A  powerful  method  that  has  developed  rapidly  since  1962  is  the  Fault  Tree 
Analysis.  This  method  may  be  viewed  as  a  systematic  and  comprehensive  investi¬ 
gation  of  a  postulated  accident  before  it  occurs.  The  term  "accident"  in  this 
case  is  used  to  signify  any  kind  of  undesired  event.  The  procedure  is  to 
define  this  undesired  event  and  to  identify  all  immediate  causes  that  could 
have  brought  it  about.  These  causes,  in  turn,  are  traced  back  through  the 
system  until  one  arrives  at  the  ultimate  causes  that  initiated  the  seguence  of 
events  that  led  to  the  undesired  event.  These  ultimate  causes  may  be  failures 
of  individual  hardware  components,  or  human  errors,  or  other  factors  which 
either  singly  or  in  combination  could  have  initiated  the  hazardous  action. 

An  immediate  result  of  such  an  analysis  is  a  highly  visible  graphical 
representation  of  all  basic  failures  and  the  paths  whereby  they  can  combine 
to  create  the  undesired  event.  The  method  also  can  be  used  quantitatively. 

If  data  are  available  for  the  probability  of  occurrence  of  the  basic  failures, 
it  is  possible  to  calculate  the  probability  of  occurrence  of  the  undesired 
event.  In  doing  so  it  is  also  possible  to  identify  those  basic  failures  that 
are  most  critical,  and  the  most  critical  sets  of  events  (scenarios),  so 
priorities  can  be  established  for  taking  corrective  action. 

An  analysis  begins  by  identifying  an  Undesired  Event  whose  causes  are  to 
be  traced.  Graphically,  this  event  is  placed  at  the  top  of  the  page  and 


NT  RESEARCH  INSTITUTE 


A-3 


represents  the  base  of  a  tree  whose  branches  are  developed  and  extend  down¬ 
ward.  Once  the  undesired  event,  also  called  a  Top  Event  is  specified,  it  is 
necessary  to  identify  the  immediate  causes  which  directly  could  cause  this  top 
event.  Each  of  these  causative  events,  in  turn,  is  further  broken  down  into 
subordinate  events. 

This  process  is  continued  until  one  arrives  at  basic  input  events  that 
cannot  be  broken  down  further,  or  for  which  probability  data  are  available 
so  there  is  no  need  to  go  further.  This  process  creates  a  diagram  which 
resembles  a  tree  whose  branches  extend  and  spread  out  downward,  with  each 
branch  terminating  in  basic  input  events. 

Figure  A2  illustrates  the  diagrammatic  arrangement  of  a  fault  tree,  and 
Figure  A3  identifies  the  goemetric  symbolism  that  is  commonly  used  in  fault 
tree  construction.  It  is  to  be  noted  that  a  fault  tree  consists  of  three 
essential  elements  --  input  events,  logic  gates,  and  output  events.  The  basic 
logic  gates  are  of  two  kinds,  namely  OR  gates  and  AND  gates.  If  an  output 
event  can  be  caused  by  one  or  more  input  events,  either  when  each  acts  by 
itself,  or  when  they  act  together,  these  input  events  pass  through  an  OR 
gate.  On  the  other  hand,  if  an  output  event  can  be  caused  only  when  all  input 
events  must  act  in  combination,  these  input  events  pass  through  an  AND  gate. 

This  concept  is  illustrated  in  Figure  A4  where  the  top  event  is  defined 
as  the  lighting  of  the  light  bulb.  For  the  circuit  diagram  which  shows  all 
the  switches  arranged  in  series,  all  four  must  be  closed  for  the  light  to  stay 
lit.  In  the  logic  diagram  for  this  arrangement,  these  three  switches  are 
shown  connected  to  an  AND  gate.  In  the  other  circuit  diagram,  where  the  four 
switches  are  arranged  in  parallel,  it  is  evident  that  the  closing  of  any  one 
switch  would  be  sufficient  to  light  the  bulb.  The  logic  diagram  for  this  case 
shows  the  four  input  events  to  pass  through  an  OR  gate.  If  the  probability 
for  each  of  the  switches  A,  B,  C,  and  D  remaining  closed  were  known,  it  would  be 
possible  to  determine  the  probability  of  the  bulb  remaining  lit  for  each  circuit. 
That  is,  the  symbolic  logic  relationships  can  be  converted  to  algegraic  ex¬ 
pressions  for  numerical  calculation. 
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Undesired 

Event 


AND  Logic  Gate 


An  event  caused  by  one  or  more  other  events 
which  are  identified 


A  basic  input  event  that  does  not  require 
further  development  as  to  causes 


An  event  which  is  not  developed  further  as 
to  its  causes  because  of  lack  of  information 
or  significance 


An  event  which  is  normal  for  the  system; 
not  a  fault  or  failure  per  se 


AND  gate  -  output  event  occurs  only  if  all 
the  input  events  are  present 


OR  gate  -  output  event  occurs  when  one  or 
more  of  the  input  events  are  present 


INHIBIT  gate  -  output  event  is  caused  by. 
input  event  only  if  specified  condition  is 
satisfied  . _ 


Attached  to  logic  gate  to  specify  a  condition 


A 

V 


Continuation  symbol  to  identical  portion 
of  fault  tree 

A  Transfer  In 
^  Transfer  Out 

Continuation  symbol  to  similar  (but  not 
identical)  portion  of  fault  tree 

^  Transfer  In 
Transfer  Out 

Symbols  Used  in  Fault  Tree  Construction 


Figure  A3 


A. 3  QUANTIFICATION  . 

IITRI  has  a  fault  tree  analysis  computer  program  for  evaluating  the  fault 
tree  diagrams.  The  first  portion  of  the  computer  code  uses  a  matrix  approach 
known  as  the  Boolean  Indicated  Cut  Set  (BIC)  method  to  reduce  the  tree  logic 
to  a  list  of  scenarios  (cut  sets)  that  "lead  to"  the  undesired  top  event  of 
the  tree.  These  cut  sets  are  the  hazard  scenarios  that  must  be  evaluated. 

Each  basic  event  on  the  fault  tree  must  be  provided  a  probability  of 
occurrence  or  a  failure  frequency  (with  associated  downtime)  for  quantification 
of  the  tree.  Four  types  of  data  had  to  be  compiled  to  quantify  the  trees: 

1.  System  Scheduling  Data 

2.  Part  Reliabilities 

3.  Human  Error  Probabilities 

4.  Initiation  Probabilities 

Scheduling  information  was  largely  inferred  from  the  Batelle  Report 
(reference  1  ).  Part  reliability  data  has  been  compiled  at  IITRI  during  prior 
hazards  and  reliability  analyses  from  numerous  sources.  The  primary  source 
of  reliability  data  used,  however,  was  a  compilation  of  non-el ectronic  parts 
data  developed  by  the  Reliability  Analysis  Center,  an  IITRI  organization  in 
Rome,  New  York  (reference  2 ) .  Human  error  data  has  been  compiled  under  a 
recent  project  conducted  by  IITRI  for  the  Chicago  Transit  Authority  (reference  3) 
and  that  was  the  primary  source  for  for  human  error  probabilities  used.  For 
initiation  probabilities,  the  primary  source  of  data  was  the  Hercules  Hazards 
Analyses  for  WADF  presented  in  the  Batelle  report  (reference  1).  The  most 

sensitive  material  for  which  data  was  available  was  used  for  each  stimulus _ 

type.  HBX-1  data  was  adopted  for  the  majority  of  cases  studied.  In  addition, 
there  were  numerous  cases  where  data  was  unavailable  and  subjective  judgements 
had  to  be  used.  For  example,  the  probability  that  a  significant  amount  of 
explosive  would  remain  is  a  vessel  during  maintenance  operations  or  that  a 
local  initiation  would  propagate  into  the  bulk  of  material  present  were  not 
easily  quantified.  Therefore,  subjective  judgements  had  to  be  used  to  esta¬ 
blish  probability  values  for  the  analysis. 
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The  criteria  for -safety  adequacy  is  stated  in  the  contract  as: 

"The  minimum  acceptable  level  of  risk  for  the  operation  and 
maintenance  for  the  entire  WADF  complex  and  any  subsystem  is  97.5 
percent  probability  with  a  95  percent  confidence  level  that  a 
category  1  or  2*  accident  will  not  happen  during  25  years  of 
operation  (40  hours  per  week)." 

This  translates  to  specifying  that  the  hazard  incident  probability  per 
year  for  the  entire  facility  is  less  than  or  equal  to  1/1000  with  a  95  percent 
confidence  level.  The  95  percent  confidence  level  criteria  will  be  evaluated 
for  the  facility  as  a  whole  using  the  dominant  cut  sets  derived  for  the 
different  plant  sections  as  the  basis.  Once  the  dominant  cut  sets  for  the 
facility  as  a  whole  have  been  identified  using  average  failure  frequencies 
and  error  probability  values,  Monte  Carlo  simulations  will  be  run  (on  these 
dominant  cut  sets)  to  develop  a  distribution  of  failure  frequencies  for 
the  WADF  as  a  whole.  The  distribution  created  for  the  WADF  will  reflect 
uncertainties  involved  in  predicting  basic  event  frequency  or  probability 
values,  for  example  due  to  variations  in  equipment,  training  of  personnel, 
scheduling,  etc.  The  95  percent  confidence  level  will  then  be  determined  using 
the  derived  distribution.  These  "total  facility"  results  will  be  presented  in 
the  final  report.  For  the  mean  time,  a  probability  criteria  of  1/10,000 
will  be  used  as  a  cutoff  value  instead  of  "1/1,000  with  a  95  percent  confidence 
level"  in  order  to  interpret  the  fault  tree  analysis  results  for  each  plant 
area. 


*  Hazard  categories  are  defined  as  follows: 

Category  1  -  Catastrophic.  May  cause  death  or  system  loss.  System  loss 
shall  be  defined  as  damage  which  results  in  the  loss  of  25  percent  or  more 
production  capability  and  requires  30  days  or  more  to  repair. 

Category  2  -  Critical.  May  cause  severe  injury,  severe  occupational  illness 
or  major  system  damage.  Major  system  damage  shall  be  defined  as  that  which 
results  in  more  than  10  percent  loss  of  production  capability  and  requires 
more  than  3  days  to  repair. 

Category  3  -  Marginal.  May  cause  minor  injury,  occupational  illness  or 
minor  system  damage.  Minor  system  damage  shall  be  defined  as  that  which 
resul  ts  in  10  percent  or  less  loss  of  production  capability  or  requires 
3  days  or  less  to  repair. 

Category  4  -  Negligible.  Will  not  result  in  injury,  occupational  illness 
or  system  damage. 
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EVALUATION  OF  EXPLOSION  HAZARDS  CREATED  BY  THE  ACCIDENTAL  DETONATION 
OF  MUNITIONS  AND/OR  COMPONENTS  WHILE  UNDERGOING  DEMILITARIZATION 

OPERATIONS 
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APPENDIX  B  EVALUATION  OF  EXPLOSION  HAZARDS  CREATED  BY  THE  ACCIDENTAL.  DETONA¬ 
TION  OF  MUNITIONS  AND/OR  COMPONENTS  WHILE  UNDERGOING  DEMILITARIZATION  OPERATIONS 

B.l.  INTRODUCTION 

A  number  of  potential  explosion  hazards  and  concerns  were  identified 
initially,  and  have  been  evaluated  in  order  to  ascertain  if  these  events  would 
create  an  unacceptable  environment  with  respect  to  the  safety  of  the  opera¬ 
tional  personnel.  These  evaluations  follow  a  rather  extensive  series  of 
blast  and  structural  response  analyses  which  were  conducted  during  the  initial 
design  and  review  processes  of  the  facility.  Thus,  the  current  study  is 
limited  to  a  few  specific  events  and  effects.  Some  of  these  previous  studies 
are  presented  in  the  list  of  references  (1  to  7). 

The  potential  explosion  hazards  evaluated  during  this  study  deal  primarily 
with  the  detonation  of  some  explosive  material  in  one  of  the  relatively  small 
working  cells,  while  the  munition  is  undergoing  one  of  many  demilitarization 
operations.  The  detonation  of  a  munition,  munition  component,  or  a  collec¬ 
tion  of  munitions  will  rapidly  release  blast  and  fragment  energy  which  may 
impose  significant  loads  upon  the  confining  structure,  and  structural  and 
mechanical  elements.  Some  of  this  energy  may  leak  out  of  the  confining 
cell  region  or  may  be  transmitted  out  due  to  the  response  of  the  structure 
and/or  its  attendant  components  such  as  doors,  access  covers,  or  frangible 
elements.  The  safety  of  the  plant  employees  or  operators  located  in  the 
adjacent  corridor  region  is  the  primary  concern  of  this  blast  hazard  evalua¬ 
tion.  Specifically,  this  study  examines  the  nature  and  intensity  of  the 
blast  waves  which  are  induced  by  the  rapid  motion  of  the  closure  devices, 
that  is  doors  and  access  covers,  as  they  respond  to  the  relatively  intense 
primary  explosion  environment  in  the  cell.  Furthermore,  this  study  examined 
the  blast  enviornment  induced  by  the  gas  blowby  or  leakage  through  the 
narrow  gaps  located  at  the  edges  of  these  closure  devices. 

In  addition  to  the  above  problems  occurring  in  the  small  working  cells, 
the  detonation  of  rather  large  quantities  of  explosive  materials  in  the 
preparation  areas  of  the  Bulk  Incinerator  Building  was  examined  with  respect 
to  the  above  door  and  access  cover  effects  as  it  may  influence  the  safety  of 
personnel  located  in  the  associated  work  corridor.  Finally,  the  safety  of 
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personnel  in  the  control  room,  due  to  the  propagation  of  blast  energy  through  the 
air  intake  system,  was  evaluated. 

The  safety  criteria  applied  in  this  evaluation  is  a  simple  peak  over¬ 
pressure  criteria  of  2.3  psig.  This  overpressure  level  is  reasonably  conser¬ 
vative  with  respect  to  the  average  response  of  working  adults  to  sudden 
pressure  increases  associated  with  blast  environments.  No  impulse  criteria  is 
included  in  this  safety  definition  due  to  the  low  overpressure  level.  In  any 
event,  when  applying  this  criteria,  the  prediction  methodology  employed  to 

estimate  the  blast  environments  must  be  reasonably  conservative  in  nature.  It 
must  be  emphasized  that  the  prediction  of  the  safety  criteria  and  the  estimation 
of  the  blast  environments  are,  at  best,  nominal. 

The  potential  multiplicity  of  the  cell  configurations,  explosion  sites, 
explosion  yields,  and  response  elements  (doors  and  access  covers),  require 
that  a  limited  series  of  specific  cases  be  evaluated  for  each  of  the  response 
modes  of  concern.  This  approach  is  warranted  due  to  the  similarity  of  these 
events  in  the  various  scenarios.  Furthermore,  the  multiplicity  of  results 
will  also  provide  some  guidance  with  respect  to  the  sensitivity  of  the  various 
parameters  which  are  involved  in  each  event.  In  general,  the  phenemona  which 
will  be  encountered  are  extremely  complex  and  difficult  to  deal  with  in  a 
precise  manner.  This  is  due  to  the  strong  nonlinearities  associated  with  the 
blast  phenomenon,  the  multidimensional  and  transient  aspects  of  the  events, 
and  to  the  real  gas  effects  of  the  strong  waves  which  influence  the  thermo¬ 
dynamic  properties  of  the  gas  (i.e.,  air).  Lorenz  (Reference  5)  presents  a 
recommended  internal  blast  loading  prediction  procedure  after  criticizing 
a  previously  used  methodology.  Such  criticism  may  be  partially  justified;  how¬ 
ever,  it  must  be  fully  recognized  that  the  internal  blast  environment,  which 
also  involves  multiple  shock  events,  is  too  complex  to  predict  accurately. 
Rather,  an  appropriate  rationale  applied  conservatively  must  be  employed. 

B.2.  CELL  PARAMETERS 

A  typical  cell  configuration  is  illustrated  in  Figure  B-l.  These  cells 
generally  consist  of  four  essentially  rigid  surfaces  and  two  frangible  surfaces 
(the  back  wall  and  the  ceiling).  Doors  and  access  ways  are  located  in  the 
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Figure  B-l  Internal  Cell  Explosion 
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fronts \yal 1  (i.e.,  the  wall  adjacent  to  the  corridor)  and,  additionally,  access 
ways  may  be  located  in  the  side  wall  to  permit  the  movement  of  material  to 
adjacent  cells  or  terminal  areas.  The  nominal  dimensions  of  these  cells  are 
approximately  15  feet  on  edge.  The  doors  considered  in  this  evaluation  are  3  ft 
by  7  ft  and  the  access  covers,  also  called  doors,  are  approximately  3  ft  by 
3  ft.  All  of  these  doors  are  of  the  sliding  type  and  are  constrained  to  move 
in  suitable  framing  systems.  The  cells  contain  a  variety  of  operational 
equipment  and  appropriate  handling  devices  for  one  or  more  munitions  depending 
upon  the  size  of  the  munitions  and  the  nature  of  the  operation  being  performed 
in  a  particular  cell. 

A  survey  was  made  of  the  uses  of  these  cells  and  a  set  or  range  of 
nominal  explosive  quantities,  as  well  as  a  maximum  explosive  weight  was  selected 
for  each  cell.  A  summary  of  these  explosive  weights  is  presented  in  Table  B-l . 
These  weights  represent  the  equivalent  TNT  weight  of  the  explosive  materials 
involved.  In  addition,  a  stand-off  distance  was  selected,  which  represents 
the  minimum  (and  therefore  a  conservative  value)  distance  between  the  explo¬ 
sion  source  and  a  door.  In  most  cases  the  angle  between  the  door  normal 
and  this  line-of-site  vector  is  small  such  that  the  primary  shock  reflection 
process  is  well  represented  by  the  normal  shock  reflection  treatment. 

Similar  data  for  the  Bulk  Incinerator  Preparation  Building  is  also  presented, 
however,  the  associated  preparation  areas  are  considerably  larger  and  are 
enclosed  by  three  frangible  surfaces.  Furthermore,  these  areas  are  partially 
below  grade.  In  this  building  the  doors  are  located  in  an  elevated  position 
and  connect  to  the  work  corridor  which  is  at  grade  level. 

The  detonation  of  a  large  quantity  of  explosive  material  within  the  cell 
will  create  a  rather  severe  blast  environment  in  almost  all  cases  considered.  .. 
The  intensity  of  the  fragment  environment  will  depend  upon  the  details  of 
the  munition,  however,  it  appears  that  most  of  these  fragments  will  be  captured 
by  the  surrounding  equipment.  It  is  clear  that  these  fragments  will  not 
compromise  the  integrity  of  the  doors  or  the  thick  concrete  walls.  Further¬ 
more,  the  fragment  enernv  and  its  effects  will  be  small  compared  to  that  of  the 
blast  energy.  The  detonation  of  several  hundred  pounds  of  TNT  in  a  closed 
region  of  the  general  size  of  these  cells  will  increase  the  mean  pressure  to 
several  hundreds  of  pounds  per  square  inch,  such  that  it  is  clear  that  the 
frangible  surfaces  are  sufficiently  far  removed  from  the  responding  elements 
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TABLE  B-l  SUMMARY  OF  EXPLOSION  WEIGHTS 


Nominal  Wt. 

Building/Room  (lb) 


Max.  Wt. 

(lb) 


Distance 

(ft) 


Preparation  Building: 

Cell  No.  2 

3 

4 

5 

6 

Mechanical  Building: 

Room  1 
2 

Cell  No.  1 
2 
3 

Bulk  Building: 

Area  No.  1 


35-200 

300 

7 

6-  60 

300 

TO 

0 

300 

10 

4-  60 

300 

12 

3-  48 

300 

12 

0-500 

500 

10 

0-500 

500 

10 

0-100 

300 

15 

0-300 

300 

15 

50-125 

300 

15 

2500 

2500 

14 
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(i.e-.v-the  doors)  that  their  influence  on  the  primary  blast  environment 
adjacent  to  the  doors  is  neglible  or  nonexistent. 

The  prediction  of  the  primary  blast  environment  is,  as  stated  above,  very 
difficult  to  define  with  any  great  accuracy.  Therefore,  the  following  conser¬ 
vative  methodology  was  adopted.  The  peak  pressure  associated  with  this 
environment  was  determined  by  using  the  normal  reflected  pressure  for  free 
air  explosion  at  the  appropriate  stand-off  distance,  and  to  use  the  impulse 
associated  with  the  reflected  pressure  wave  for  a  surface  burst  (an  effective 
2W  source),  again,  at  the  appropriate  stand-off  distance.  This  simple  pro¬ 
cedure  assumes  that  the  maximum  pressure  of  the  primary  explosion  environment 
in  the  cell  at  the  door  location  (an  average  load  over  the  door  area)  is  due 
to  the  reflection  of  the  incident  or  primary  shock  wave,  and  that  the  impulse 
associated  with  the  additional  shock  reflection  effects  from  adjacent  rigid 
surfaces,  which  will  increase  the  local  pressure  environment  at  later  times, 
are  adequately  accounted  for  by  increasing  the  source  strength.  In  general 
the  explosion  environment  is  rather  short  lived,  say  a  few  milliseconds  or 
less.  Furthermore,  the  shock  arrival  time  will  also  be  very  short,  again, 
about  one  millisecond.  These  time  comparisons  clearly  indicate  that  the 
potential  relief  effects  from  the  failure  of  the  frangible  surfaces  will  not 
influence  the  local  blast  environment  at  the  corridor  wall  of  the  cells. 

The  above  procedure  is  considered  to  be  conservative  and  is  consistent 
with  the  internal  cell  loading  methodology  defined  in  TM5-1300  (Reference  B-8). 
The  TM5-1300  procedure  was  not  used  since  it  is  limited  to  the  prediction  of 
the  average  load  over  the  entire  wall.  In  the  current  evaluation  the  pertinent 
area  is  limited  to  the  door  area.  TM5-1300  was  used  as  the  primary  source 
for  the  blast  data  used  in  the  analysis.  It  was  further  assumed,  in  the 
current  analysis,  that  the  influence  of  the  added  impulse  due  to  multiple 
shock  reflection  effects,  tends  to  increase  the  late  time  pressure  environment 
such  that  the  pressure-time  wave  shape  becomes  essentially  linear.  In  this 
manner  a  pressure  pulse  duration  could  be  readily  determined.  A  summary  of  the 
primary  blast  environment  parameters  are  presented  in  Table  B-2.  It  should 
be  noted  that  for  most  of  the  severe  environments  encountered,  that  the  scaled 
distance  range  the  basic  blast  data  is  somewhat  uncertain.  In  part,  for  this 
reason  the  above  defined  procedure  was  used.  The  use  of  the  linear  wave  shape 
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TABLE  B-2  SUMMARY  OF  PRIMARY  BLAST  ENVIRONMENT 
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was  also  motivated  by  the  convenience  that  it  affords  in  some  of  the  subsequent 
analyses.  It  must  be  emphasized  that  these  assumptions  did  not  significantly 
influence  the  subsequent  results  of  the  evaluation  since  most  of  the  severe 
effects  can  be  attributed  to  the  early  portion  of  the  primary  blast  environment. 

3.  DOOR  MOTION  ANALYSIS 

The  blast  doors  used  as  the  closure  devices  in  these  cells  are  solid 
steel  plates,  2  to  3  inches  thick,  which  cover  the  entire  wall  penetration  or 
opening.  These  doors  are  constrained,  as  needed,  by  suitable  framing  systems, 
but  are  separated  from  the  wall  or  framing  by  a  narrow  gap  or  clearance  which 
permits  the  relatively  free  sliding  motion  needed  for  normal  door  operation. 

Thus,  the  rapid  application  of  a  rather  severe  blast  load  will  cause  the  plate 
to  translate  towards  the  wall,  reducing  the  gap  width  until  the  plate  impacts 
on  the  wall /rail  system  at  its  edges.  The  door  will  continue  to  move  until  the 
load  is  relieved  and  the  kinetic  energy  is  converted  to  the  deformation  of 
the  plate,  however,  this  average  translational  motion  will  be  associated  with 
a  buckling  or  bending  mode  of  the  plate.  The  following  analysis  will  demonstrate 
that  the  plate  will  impact  its  supports  rather  early  in  its  loading  phase, 
say  0.3  to  1  ms  after  the  application  of  the  load.  Furthermore,  since  the 
frequency  of  the  plate  in  its  lowest  mode  of  vibration  is  approximately  80  cps, 
the  loading  phase  will  terminate  before  plate  rebound  will  occur.  Maximum 
displacement  will  occur  approximately  3  ms  after  impact.  At  this  time  the 
average  velocity  will  be  zero. 

The  rapid  motion  of  the  plate,  as  defined  by  its  average  translation 
velocity,  will  induce  a  blast  pressure  environment  in  the  corridor  region. 

The  blast  wave  will  initially  be  confined  to  the  wall  recess  (about  3.5  to  5 
ft  long)  region  but  will  subsequently  propagate  out  into  the  general  corridor 
region  in  a  substantially  weakened  form.  The  following  analysis  will  define 
the  strength,  duration  and  general  wave  shape  of  this  induced  blast  wave 
as  it  exists  in  the  recess  region.  Since  operational  personnel  may  be  at 
the  door  location  (i.e.,  in  the  recess  region)  during  an  explosion  event,  this 
location  is  a  meaningful  one. 

The  analysis  methodology  treats  the  plate  as  a  free  lumped  mass  per 
unit  area  with  a  single  degree  of  freedom,  i.e.,  undergoing  a  translational 
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motion.  This  linear  motion  is  applicable  prior  to  and  after  any  impact  effects. 
The  following  velocity  and  displacement  relationships  are  valid  prior  to 
impact: 


and 


where 


x 


1 


1  1_ 
3  *0 


(1) 

(2) 


u  =  plate  velocity 

x  =  plate  displacement 

t  =  time 

Pq  =  peak  pressure  or  primary  blast  environment 

t  =  duration  of  primary  blast  environment 
o 

w  =  weight  per  unit  area  of  plate 

After  impact  occurs,  the  center  portion  of  the  door  will  tend  to  move  as  a 
free  mass  as  described  by  the  above  relationships,  whereas  the  velocity  of  the 
edge  of  the  plate  will  impulsively  change  to  zero.  The  average  plate  velocity 
will  be  somewhere  between  these  limits  as  illustrated  in  Figure  B-2  (a).  The 
assumed  form  of  the  average  velocity  after  impact  occurs  approximates  a  quarter 
sine  wave  which  connects  the  impact  point  with  the  zero  velocity  point  three 
milliseconds  after  impact. 
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motion  of  the  plate  will  induce  a  blast  wave  which,  for  moderately 
weak  waves,  is  defined  by  the  following  characteristic  equation: 

2K 

['*¥  i.]™  -  '  ■  (3> 

4 

where 

Ap  =  overpressure 
P®  =  ambient  pressure 
k  =  ratio  of  specific  heats 
c«  =  ambient  sound  velocity 

If  the  blast  wave  is  very  weak,  then  the  above  relationship  reduces  to: 

ip  .  JsEai  (4) 

r  C00 

At  low  overpressure  levels  the  individual  disturbances  will  propagate  in  such 
a  manner  that  wave  coalescence  will  not  be  significant.  Thus,  the  pressure 
history  will  be  proportional  to  the  velocity  history,  i.e.,  they  will  have 
similar  shapes. 

The  doors  of  the  small  cells  are  2  inches  thick  and  have  a  nominal  clear¬ 
ance  at  the  head  and  jamb  edges  of  approximately  1/4  inch.  These  3  ft  by  7  ft 
doors  have  gaps  of  approximately  1/8  inch  along  the  floor  edge.  This  latter 
gap  does  not  close  as  the  plate  is  translated  and  thus  this  edge  remains  free 
during  the  impact  process.  The  corresponding  doors  in  the  Bulk  Incinerator 
Building  are  similar,  exceot  they  are  3  inches  thick.  The  access  covers  are 
1-3/8  inches  thick  and  aDDear  to  have  a  somewhat  smaller  gap.  Furthermore, 
some  seals  may  be  present  in  the  gaps  of  the  access  covers,  however  the  extreme 
blast  pressures  will  blow  these  seals  out.  A  selected  set  of  results  is 
presented  in  Table  B-3  and  indicates  that  the  peak  overpressures  are  slightly 
greater  than  2  psig  for  the  doors.  Four  typical  pressure  histories  are 
presented  in  Figure  B-2  (b).  The  results  presented  in  the  table  include  the  peak 
overpressure,  the  corresponding  peak  velocity  (the  impact  velocity),  and  the 
time  of  impact.  The  total  duration  of  these  blast  waves  are  approximately 
3  ms  longer  than  the  time  of  impact.  A  similar  examination  of  the  thinner  access 
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Center  Motion 


Fiqure  B-2  Overpressure  Histories  due  to  Door  Motion 
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NOTE:  Doors  are  solid  steel  -  2  in.  thick  with  an  initial  separation  of  0,25  in 


plates -.indicated  that  the  induced  blast  environment  is  approximately  the  same. 

The  peak  pressure  would  be  approximately  20  percent  larger  if  a  1/4  inch  gap  is 
used  and  approximately  10  percent  less  if  a  1/8  inch  gap  is  used.  It  is  clear 
that  the  blast  waves  which  are  induced  by  the  rapid  displacement  of  the  enclosure 
plates  are  acceptable  with  respect  to  the  safety  of  the  operating  personnel. 

While  a  few  results  exceed  the  2.3  psia  safety  criteria  (for  the  access  covers) 
the  degree  of  conservatism  used  in  the  analysis  is  sufficient  to  conclude 
that  this  effort  does  not  represent  a  significant  hazard  to  the  operators 
located  in  the  ad.iacent  corridors  of  these  cells  during  an  exDlosion  event. 
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4.  GAS  BLOWBY  ANALYSIS 

The  presence  of  very  high  pressure  gas  in  the  vicinity  of  the  doors  and 
their  edge  gaps,  allows  a  jet  of  energetic  gas  to  flow  through  the  thin  gap 
and  enter  the  recess  region  on  the  corridor  side  of  the  door.  The  rapid  injec¬ 
tion  of  this  gas  and  its  subsequent  expansion  to  significantly  lower  pressures 
will  generate  a  pressure  wave  in  this  recess  region  which  will  then  propagate 
out  into  the  general  corridor  region.  This  process  is  illustrated  in  Figure  B-3 
(a).  The  interface  defines  the  boudary  between  the  injected  gas  and  the 
ambient  air  which  was  originally  in  this  region.  The  injection  of  the  gas  acts 
like  a  piston  and  the  ambient  air  is  compressed  to  make  room  for  this  addi-  - 
tional  material.  The  mass  flow  rate  associated  with  the  leakage  will  correspond 
to  sonic  flow  due  to  the  very  high  pressures  in  the  primary  blast  region.  This 
region  acts  as  a  time  dependent  reservoir  and  the  properties  of  the  gas  in  this 
region  will  have  a  sianificant  influence  upon  the  mass  flow  rate  and  the  sub¬ 
sequent  blast  wave  in  the  recess  region.  The  quantity  of  the  gas  injected  by 
this  process  will  denen^  uoon  the  properties  of  the  gas,  the  time  deoendent 
decay  of  the  pressure,  and  the  time  dependent  size  of  the  gap.  The  latter  has 

already  been  defined  implicitly  bv  the  Drevious  analvsis  of  t.hp  motion  of  the 
plate  loaded  by  the  primary  blast  environment. 

The  pressure  in  the  recess  region  is  difficult  to  define  with  great 
precision  due  in  part  to  the  complex  geometry  of  the  region  (i.e.,  highly 
three  dimensional  in  the  scale  of  the  jets),  and  to  secondary  phenomenon  such 
as  mixing.  Furthermore,  the  state  of  the  gas  in  the  primary  blast  region 
is  significantly  altered  by  real  gas  effects.  The  former  can  be  grossly 
accounted  for  by  employing  a  one-dimensional  representation  of  the  blast  wave 
in  the  recess  region.  The  latter  was  determined  by  using  the  thermodynamic 
properties  of  air  (Reference  B-9)  in  a  manner  corresponding  to  the  double  shock 
processes  associated  with  the  primary  wave  and  its  reflection  from  the 
essentially  rigid  surfaces  of  the  cell.  The  mass  flow  rate  will  be  proportional 
to  the  density  and  the  sound  velocity  corresponding  the  the  peak  pressure  state 
in  the  primary  blast  region.  Typically,  for  the  more  intense  cases,  the 
density  of  this  state  will  be  approximately  twenty  times  the  ambient  air 
density  and  the  sound  velocity  will  be  about  four  times  the  ambient  air  sound 
velocity.  Fortunately,  the  dependence  upon  the  density  is  removed  when  the 
pressure  formulation  is  developed.  Thus,  at  least  this  uncertainty  is  eliminated. 
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Floor  Gap  (a)  Physical  Configuration 


Time  (ms) 

(b)  Pressure  History 


Figure  B-3  Blast  Environment  Due  To  Gas  Blowby  At  Doors 


,The  results  indicate  that  rather  strong  blast  waves  are  generated  in  the 
recess  region.  Furthermore,  the  duration  of  these  pressure  waves  are  rather 
short  (i.e.,  equal  to  the  impact  time  of  the  elate),  such  that  some  wave  shape 
distortion  is  expected  to  occur  as  the  disturbance  propagates  in  the  recess 
region.  A  representative  case  is  illustrated  in  Figure  B-3  (b).  The  following 
relationship  is  based  upon  the  equality  of  the  volume  rate  of  flow  of  the 
injected  gas  and  the  volume  rate  of  flow  corresponding  to  the  compression  of 
the  ambient  air.  Furthermore,  the  pressure  of  both  gases  at  the  interface  are 
equal.  The  relationship  is: 

sMC-4W#'“7  <5) 

where  the  shock  strength  is 


(e-l)  e 


U.  /  14 


■/n«r 


=  0.168 


and 


A  =  area  of  the  gap 
A*  =  area  of  the  door 

cQ  =  sound  velocity  of  the  reference  primary  blast  region 

P  =  pressure  of  the  gas  in  the  primary  blast  region 

The  factor  0.168  includes  an  orifice  coefficient  of  0.6  as  well  as  other  factor 
inherent  in  the  gas  dynamic  relationships  used  in  this  formulation.  In  view 
of  the  complex  wave  shape  inherent  in  this  process  (see  Figure  B-3  [a])  peak 
values  can  be  readily  obtained  by  simplifying  the  above  equation  to  time  equal 
to  zero  where  the  pressure  ratio  in  the  primary  explosion  region  is  unity  and 
the  gap  area  is  equal  to  its  initial  value. 

Representative  results  are  presented  in  Table  B-4  and  clearly  indicate 
that  the  transmitted  blast  environment  in  the  recess  region  and  hence  in  the 
corridor  proper  is  very  intense  and  violates  the  safety  criteria  of  a  2.3 
psig  peak  overpressure.  Tt  should  be  noted  that  the  wave  lengths  of  these  intense 
pressure  waves  are  of  the  order  of  0.5  ft,  thus,  it  is  unlikely  that  the  one- 
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TABLE  B-4  PEAK  PRESSURE  ENVIRONMENT  DUE  TO  GAS 
BLOWBY  AT  DOORS 


Buildinq/Cell/Wt. 

Peak 
3X7  Door 

Pressure  (psi) 

(3X3  Door  (Port) 

Duration  (ms) 

Preparation  Bldg: 

Cell  No.  2/Max. 

28.7 

41.2 

0.36 

2/Nom. 

22.8 

32.7 

0.41 

3/Nom. 

4.8 

7.1 

1.06 

6/Max. 

10.3 

14.8 

0.64 

6/Nom. 

2.0 

2.9 

1.61 

Mechanical  Bldg: 

Cell  No.  3/Max. 

6.6 

9.7 

0.83 

3/Nom. 

0.6 

0.9 

2.92 

Bulk  Bldg: 

Door 

29.1 

- 

0.42 

Port 

- 

42.3 

0.34 
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dimensional  represntation  used  is  valid.  It  is  more  likely  that  the  blast  energy 
will  be  diffused  over  a  larger  volume  and,  perhaps,  dispersed  more  in  time. 

Thus,  the  peak  overpressures  may  only  be  one-half  of  the  values  indicated  by 
the  above  analysis  methodology.  Attenuation  effects  were  examined  and  it 
would  appear  that  no  significant  wave  attenuation  would  take  place  before  the 
wave  propagates  2  to  3  feet.  Based  on  these  results,  it  must  be  concluded  that 
a  real  and  somewhat  significant  hazard  to  operating  personnel  in  the  corridor 
region  could  exist  for  the  explosion  scenarios  treated.  It  should  be  noted, 
however,  that  although  the  2.3  psig  peak  overpressure  will  be  exceeded  in  many 
of  the  cases  evaluated,  the  pulse  duration  would  be  quite  short.  Based  on  data 
in  reference  B-10,  it  appears  that  the  predicted  pressure-time  histories  would 
at  most  cause  eardrum  damage,  and  may  not  reach  that  threshold. 

A  supplementary  evaluation  was  made  of  this  gas  blowby  effect  to  establish 
the  sensitivity  of  the  gap  size  to  the  intensity  of  the  transmitted  blast 
environment.  These  results  are  presented  in  Table  B-5.  The  results  indicate 
that  substantial  reductions  in  the  gap  size  must  be  implemented  in  order  to 
achieve  a  safe  environment  in  the  adjacent  corridor  region.  It  should  be  noted 
that  as  the  gap  size  is  reduced  the  wave  length  also  becomes  small  such  that  the 
one-dimensional  representation  becomes  even  poorer.  A  gap  width  of  0.032 
inches  would  probably  be  adequate  since  a  great  deal  of  local  mixing  of  the 
two  gases  will  occur.  Finally,  it  should  be  noted  that  this  gas  blowby  effect 
and  the  previous  plate  motion  effects  are  additive,  although  not  necessarily 
in  an  algebraic  sense. 

5.  BLAST  ENVIRONMENT  IN  CONTROL  ROOM 

The  detonation  of  2500  lb  of  equivalent  TNT  in  the  slurry  tank  located  in 

the  preparation  area  of  the  Bulk  Incinerator  Preparation  Building  would  generate 

a  rather  strong  blast  environment  which  will  propagate  away  from  the  building 

and  sweep  past  the  air  intake  structure  or  duct  which  provides  fresh  air  to 

the  compliment  of  underground  rooms  in  this  complex.  The  free  air  blast  wave 

will  enter  this  duct,  propagate  through  the  duct,  and  enter  the  Mechanical 

room.  The  blast  wave  will  then  diffract  into  the  room  and  loose  its  intensity, 

but  the  mass  injection  caused  by  this  wave  will  pressurize  this  room  and  any 

others  which  are  connected  to  it.  This  problem  was  examined  previously 

(Reference  B-l),  however,  the  analysis  was  deficient.  The  explosion  was 
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TABLE  8-5  GAP  SENSITIVITY  FOR  GAS  BLOWBY  EFFECT  -  CASE  B 


Initial  Gap 
(in) 

Peak  Pressure 
ipsi) 

Duration 

(rri) 

Wave  length 
(ft) 

.250 

28.7 

0.36 

0.67 

.125 

15.6 

0.25 

0.38 

.063 

8.4 

0.17 

0.24 

.032 

4.8 

0.12 

0.16 

.016 

2.3 

0.09 

0.10 
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treated, as  a  free  air. source.  The  explosion  source  is  located  close  to  the 
cell  floor;  a  distance  which  is  small  compared  to  the  range  of  the  air  intake. 
Thus,  the  explosion  environment  at  the  intake  location  will  be  in  the  Mach  region 
and  the  appropriate  burst  condition  is  a  surface  burst  condition.  The  previous 
analysis  also  used  a  shorter  range  than  that  which  is  indicated  at  the  present 
time.  The  blast  environment  used  at  the  intake  location  in  that  analysis  was 
a  14.0  psi  peak  overpressure  wave  with  a  duration  of  16.3  ms.  The  current 
treatment  indicates  that  the  blast  environment  corresponds  to  a  peak  over¬ 
pressure  of  14.5  psig  and  a  duration  of  26.0  ms.  While  these  two  pressure 
waves  are  not  grossly  different,  the  previous  analysis  did  not  define  the 
strength  and  duration  of  the  blast  wave  entering  the  Mechanical  room.  A 
graphical  method-of-characteri sties  solution  was  performed  and  the  results 
are  presented  in  Figure  B-4  together  with  an  illustration  of  the  general  duct 
configuration.  A  total  duct  length  of  75  feet  was  used.  The  influence  of  the 
light  sheet  metal  intake  structure  was  neglected  on  the  assumption  that  the 
free  air  blast  wave  would  quickly  destroy  this  superstructure.  The  blast  wave 
entering  the  duct  undergoes  some  attenuation  such  that  the  peak  overpressure 
of  the  wave  which  enters  the  Mechanical  room  is  approximately  8.2  psig  and  has 
a  duration  of  approximately  42  ms.  The  cavity  filling  process  increases  the 
pressure  in  the  Mechanical  room  by  only  0.21  psig,  a  value  which  is  comparable 
to  the  0.13  psi  increase  predicted  by  the  previous  analysis  for  the  somewhat 
less  intense  wave.  It  is  clear  that  with  respect  to  the  gradual  pressure 
increase  in  this  and  possible  adjacent  rooms,  the  blast  environment  in  the 
underground  complex,  which  includes  the  Control  room,  is  small  and  the  area 
can  be  judged  to  be  safe  for  plant  personnel.  However,  it  must  be  noted 
that  the  8.2  psi  peak  overpressure  blast  wave  which  enters  the  Mechanical  room 
does  represent  a  substantial  hazard  to  any  personnel  in  that  room,  especially 
if  they  are  near  the  air  duct.  Considering  the  arrangement  of  the  rooms  in 
this  underground  complex,  it  appears  that  some  personnel  may  use  the  Mechanical 
room  as  a  pathway  rather  than  pass  through  the  supervisors  office;  especially 
when  one  considers  the  potential  routes  between  the  washroom  and  the  Control 
room. 
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Overpressure,  (psig) 


Intake  Structure 


Free- Air 


Figure  B-4  Explosion  Environment  for  Air  Intake  Duct 
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6.  -CONCLUSIONS 

The  evaluation  of  explosion  hazards  created  by  the  accidental  detonation 
of  munitions  while  undergoing  demilitarization  operations  was  examined  for 
three  general  scenarios  or  events.  These  include  the  induced  blast  wave 
generated  by  the  motion  of  doors  and  access  covers  due  to  the  intense  primary 
blast  environment  which  will  exist  within  the  cell  when  an  explosion  occurs. 
This  phenomenon  produced  blast  waves,  which  for  the  more  severe  cases 
examined,  had  peak  overpressure  levels  of  approximately  2.0  to  2.5  psig. 

These  blast  environments  essentially  met  the  2.3  psig  peak  overpressure 
safety  criteria. 

The  second  analysis  dealt  with  the  blast  energy  which  was  transmitted 
to  the  working  corridor  by  high  pressure  gas  blowby  through  the  small  gaps 
located  along  the  edge  of  these  closure  devices.  For  this  phenomenon,  the 
blast  waves  transmitted  to  the  working  corridor,  in  many  instances  were 
quite  intense  (approximately  30  to  40  psig  peak  overpressures).  Hence,  a 
serious  blast  hazard  does  exist  for  operating  personnel  located  in  the  adjacent 
corridor  when  a  large  explosion  occurs  in  the  cell. 

Finally,  the  pressure  environment  within  the  Control  room  of  the  Bulk 
Incinerator  Preparation  Building  was  examined.  The  pressure  rise  in  the 
underground  rooms  due  to  the  transmission  of  a  blast  wave  propagating  through 
the  air  intake  duct  is  very  small  (approximately  0.2  psig).  However,  the  blast 
wave  which  enters  the  Mechanical  room  is  intense  (a  peak  overpressure  of 
8.2  psig)  and  it  represents  a  hazard  to  any  personnel  which  may  be  in  this 
room  when  the  slurry  tank  detonates.  Personnel  are  not  normally  permitted  _ 
in  the  room,  however,  they  may  make  use  of  this  room  as  a  convenient  path 
between  the  Control  room  and  the  washroom. 
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